pi-goal-list-loop-audit 0.38.46 → 0.38.47

package/CHANGELOG.md

@@ -1,5 +1,15 @@
 # Changelog
 
+## 0.38.47 — layered prompts: skeleton plus on-demand detail (2026-09-11)
+
+### Changed
+
+- **Prompt layers:** every `prompts/*.md` file is now a static skeleton plus on-demand detail blocks (`<!-- glla-layer: detail <id> -->`). The continuation template carries three conditional details — `auditor-disapproval` (live disapproval), `survey-pivot` (survey objective), `session-restart` (resync/recovery) — loaded only when their trigger is already known at render time; loop, draft, and plan prompts are skeleton-only (per-iteration essential or already file-granular on-demand). Static layers resolve before dynamic substitution, in file order every turn.
+- **Measured saving:** clean-scenario full continuation render drops 24,347 to 21,801 chars (~10%, est. tokens 6,087 to 5,451); firing predicates re-add exactly their own bodies.
+- **Loud failure:** a missing prompt file, unclosed/duplicate block, or unknown detail id throws naming the file — the `[template-not-found]`, inline mini-prompt, and `[DRAFTING] Clarify` silent fallbacks are gone.
+- **Mid-turn contingencies stay put:** subagent death, provider errors, detached commits, stalls, and task workflow remain in the skeleton (their trigger cannot be known before the turn; no mid-turn fetch exists).
+- **Pins:** `tests/prompt-layers.test.ts` (19) — full-assembly render-diff for all 7 files, exact-delta proofs, loud-missing, order determinism; `tests/context-growth-measurement.test.ts` and `tests/context-checkpoint.test.ts` re-baselined deliberately (deltas verified byte-exact against a pre-change worktree).
+
 ## 0.38.46 — rich Antigravity-style terminal summaries (2026-09-11)
 
 ### Changed

package/INSTALL.md

@@ -31,11 +31,11 @@ GLLA loads into new pi sessions. If pi is already open, reload that session:
 
 ## Updating
 
-The status line always shows the running version (`glla: … · v0.38.44`).
+The status line always shows the running version (`glla: … · v0.38.46`).
 When the npm registry is ahead, it also nudges:
 
 ```text
-glla: … · v0.38.43 · update v0.38.44 available
+glla: … · v0.38.45 · update v0.38.46 available
 ```
 
 The nudge comes from a daily sidecar check (`.pi-glla/update-check.json`),
@@ -45,7 +45,7 @@ refreshed on command contact and never blocking a turn. To update:
 pi install npm:pi-goal-list-loop-audit@latest
 ```
 
-Then `/reload` every open pi session — a session keeps running the
+Then `/reload` every open pi session: a session keeps running the
 version it loaded with until reloaded. `/glla version` says whether the
 current session is stale and repeats the update command.
 
@@ -58,7 +58,7 @@ and confirmation UX:
 pi install npm:@juicesharp/rpiv-ask-user-question
 ```
 
-For best automation and quality, add the **pinned parallel-orchestration companion** (`pi-subagents` 0.62.0) — GLLA's power-max choice for `runs.all` fan-out, `runs.lanes` worker→review→fix chains, structured verification, worktree isolation, and durable recovery:
+For best automation and quality, add the **pinned parallel-orchestration companion** (`pi-subagents` 0.62.0): GLLA's power-max choice for `runs.all` fan-out, `runs.lanes` worker→review→fix chains, structured verification, worktree isolation, and durable recovery:
 
 ```bash
 pi install npm:pi-subagents@0.62.0
@@ -260,9 +260,9 @@ supervisor, or let it own the session instead of GLLA.
 
 ## Further reading
 
-- [`README.md`](README.md) — product overview, first-use guide, commands,
+- [`README.md`](README.md): product overview, first-use guide, commands,
   companion policy, autonomy model, recovery, and maintainer map;
-- [`docs/DESIGN.md`](docs/DESIGN.md) — architecture and design decisions;
-- [`docs/INDEX.md`](docs/INDEX.md) — shipped and repository-only documentation;
-- [`docs/RELEASING.md`](docs/RELEASING.md) — release process;
-- [`CHANGELOG.md`](CHANGELOG.md) — version history.
+- [`docs/DESIGN.md`](docs/DESIGN.md): architecture and design decisions;
+- [`docs/INDEX.md`](docs/INDEX.md): shipped and repository-only documentation;
+- [`docs/RELEASING.md`](docs/RELEASING.md): release process;
+- [`CHANGELOG.md`](CHANGELOG.md): version history.

package/README.md

@@ -94,7 +94,7 @@ Done when:
 ```
 
 The contract is the important part. Replace the example with the result you
-actually want and checks that another person—or another agent—could inspect.
+actually want and checks that another person (or another agent) could inspect.
 
 For an objective that needs shaping, start with bare `/goal` and answer the
 interview. GLLA will research the ambiguity, ask focused questions, and show a
@@ -132,7 +132,7 @@ forcing every problem into a loop.
 | `/list` | Several outcomes or a backlog of independently verifiable items | Each item is worked and audited separately; the queue advances safely |
 | `/loop` | Ongoing improvement with no single final item | A metric, specification, audit cadence, bound, or `/loop stop` ends the process |
 
-### `/goal` — one outcome
+### `/goal`: one outcome
 
 ```text
 /goal                                      # interview + Confirm
@@ -152,7 +152,7 @@ A goal is the best default for work with a finish line. If the agent discovers
 that the objective is too large, it can propose a bounded task plan instead of
 quietly inventing an unbounded backlog.
 
-### `/list` — a durable work pool
+### `/list`: a durable work pool
 
 ```text
 /list "fix the cache. Done when: tests pass"
@@ -179,11 +179,11 @@ bounded bootstrap turn containing `propose_task_list`. Confirm the redraft;
 automatic repeats are fenced. Use `/list resume` or `/glla resume` for an
 intentional retry of a waiting/restored queue, and `/list next` when you
 intentionally want to skip or choose another queued item. `/list start` is
-also explicit: it activates the queued head, or—when the queue is empty—uses
+also explicit: it activates the queued head, or, when the queue is empty, uses
 one clear recent user request as a seed for the normal Confirm-gated list
 drafting flow. Ambiguous context is never queued automatically.
 
-### `/loop` — an improvement process
+### `/loop`: an improvement process
 
 ```text
 /loop                                     # interview + Confirm
@@ -274,13 +274,13 @@ GLLA is the supervisor. These companions add capabilities around it:
 
 ### Recommended for almost everyone
 
-- **`@juicesharp/rpiv-ask-user-question`** — structured questions, multi-select,
+- **`@juicesharp/rpiv-ask-user-question`**: structured questions, multi-select,
   previews, and Confirm dialogs for drafting and decisions. GLLA has a prose
   fallback, but this is the intended UX.
 
-### Recommended for power — parallel orchestration (`pi-subagents`)
+### Recommended for power: parallel orchestration (`pi-subagents`)
 
-- **`pi-subagents` 0.62.0 (pinned) — the power-max choice for GLLA.** Use it
+- **`pi-subagents` 0.62.0 (pinned): the power-max choice for GLLA.** Use it
   when you want the best automation and quality: `runs.all` parallel fan-out,
   `runs.lanes` worker→review→fix chains, `outputSchema` + `acceptance` structured
   verification, `runs.host` gated shell, worktree isolation, model routing
@@ -295,7 +295,7 @@ GLLA is the supervisor. These companions add capabilities around it:
 
   The main pi session remains the owner of the goal/list/loop; subagents are
   workers and cannot silently replace the parent's objective. A short or mostly
-  sequential goal can still run cleanly without workers — install when
+  sequential goal can still run cleanly without workers; install when
   parallelism will pay for its coordination and model usage.
 
   Display coexistence: pi-subagents renders its own inline run panels +
@@ -304,7 +304,7 @@ GLLA is the supervisor. These companions add capabilities around it:
   swapping order, set pi-subagents `inlineToolDisplay: "summary"` (one
   stable row per run) and pin `fleetViewPlacement`; GLLA's own richness is
   the `subagentDisplayRichness` setting (`/glla` → Subagents): `rich`
-  (default — worker rows + task linkage), `compact` (count line), `quiet`
+  (default: worker rows + task linkage), `compact` (count line), `quiet`
   (hung/aborting workers only). Upstream triple-render report:
   nicobailon/pi-subagents#1931.
 
@@ -319,17 +319,17 @@ recommendation in the same session. Existing Tintin-era agent files are
 cleaned only when GLLA's management marker proves that GLLA owns them; old
 settings are not silently remapped to a different role. Do not stack
 `@quintinshaw/pi-dynamic-workflows` as a competing orchestrator alongside
-GLLA + `pi-subagents` in the same session — duplicate tools and competing
+GLLA + `pi-subagents` in the same session: duplicate tools and competing
 orchestration events create ambiguous ownership. Use its quality helpers
 (`verify`/`judgePanel`/`loopUntilDry`) only as isolated complements if needed.
 
 ### Useful, but optional
 
-- **`@pi-unipi/notify`** — Telegram, Gotify, or ntfy delivery when you need
+- **`@pi-unipi/notify`**: Telegram, Gotify, or ntfy delivery when you need
   alerts away from the desktop. GLLA's local notifications work without it;
   when no command is configured, it auto-detects `notify-send`/`osascript`;
   `notify=off` silences notifications.
-- **`pi-chrome`** — logged-in browser research and interaction when a goal needs
+- **`pi-chrome`**: logged-in browser research and interaction when a goal needs
   a real web session. It is not required for repository-only work.
 
 ### What not to combine with GLLA
@@ -501,4 +501,4 @@ repository material, not first-use package content.
 
 ## License
 
-GNU Affero General Public License v3.0-only — see [LICENSE](LICENSE).
+GNU Affero General Public License v3.0-only; see [LICENSE](LICENSE).

package/docs/INDEX.md

@@ -1,16 +1,14 @@
-# docs/ — index
+# docs/ index
 
 Ordered by reading path, not alphabetically.
 
 ## Active focus (recent work, durable artifacts)
 
-This package's policy contracts and recent changes are recorded in
-the audit/ directory of the **repository checkout** — it is not
-shipped in the npm tarball (see "Repository-only material" below).
+Policy contracts and recent changes live in the `audit/` directory of the
+**repository checkout**; that directory is not shipped in the npm tarball
+(see "Repository-only material" below). The shipped entry points are:
 
-For shipped docs, the relevant entry points are:
-
-- `../CHANGELOG.md` — user-facing changelog; an `Unreleased` section may lead
+- `../CHANGELOG.md`: user-facing changelog; an `Unreleased` section may lead
   the file, followed by the current released version. v0.35.5 adopted the six-label completion
   recap; v0.35.6 added typed-boundary regression pins; v0.35.7 added
   deterministic fast-fail pre-audits, zero-pause autonomous execution, and
@@ -18,7 +16,7 @@ For shipped docs, the relevant entry points are:
   failback; v0.35.9 hardened cross-version npm tarball checks; v0.35.10
   handles multi-entry npm dry-run reports; v0.35.11 accepts both npm report
   shapes; v0.35.12 supports npm 12's keyed pack reports; v0.35.13 fixes stale-API recovery loops.
-  v0.35.14–v0.38.46 continue through the supervisor freeze (`/glla pause`),
+  v0.35.14–v0.38.47 continue through the supervisor freeze (`/glla pause`),
   load hold, auditor picker parity, Windows launch fix, zombie-watchdog
   subagent carve-out, due-wait backstop, the `/glla agents` visibility panel,
   durable state-root selection, blank-until-resume auditor context, frozen
@@ -28,43 +26,43 @@ For shipped docs, the relevant entry points are:
   packed-artifact release verification, and the 2026-09-07 display/lifecycle/
   settings audit pass (abort-latch send guards, ownership compare-and-swap,
   auditor inherit/clear parity) and the v0.38.25 post-objective summary
-  (canonical approval render, persist + replay, audit-goal counts line), the v0.38.27 selective port of PRs #45/#46 (`/loop pause` soft-hold, widget subtask count), the v0.38.28 provenance-row closure fix, and the v0.38.29 compact active-card recovery/judgment projection — see CHANGELOG.md for the full trail.
-- `../README.md` — what the plugin is, install, quickstart, and the
+  (canonical approval render, persist + replay, audit-goal counts line), the v0.38.27 selective port of PRs #45/#46 (`/loop pause` soft-hold, widget subtask count), the v0.38.28 provenance-row closure fix, and the v0.38.29 compact active-card recovery/judgment projection; see CHANGELOG.md for the full trail.
+- `../README.md`: what the plugin is, install, quickstart, and the
   architectural guarantee (drafting + confirm + detached auditor).
-- `../INSTALL.md` — source install / local development setup; the recommended
+- `../INSTALL.md`: source install / local development setup; the recommended
   companion plugins and the `auditor reads / writes are path-checked`
   note.
 
 ## Entry points
-- `../README.md` — what the plugin is, install, quickstart
-- `SETTINGS.md` — canonical settings reference (files, precedence, every key)
-- `../INSTALL.md` — source install / local development setup
-- `../CHANGELOG.md` — user-facing changelog; the first versioned heading is
+- `../README.md`: what the plugin is, install, quickstart
+- `SETTINGS.md`: canonical settings reference (files, precedence, every key)
+- `../INSTALL.md`: source install / local development setup
+- `../CHANGELOG.md`: user-facing changelog; the first versioned heading is
   the current released package version (use `/glla version` to compare with
   the registry); post-release work may appear in `Unreleased` above it.
 
 ## Architecture
-- `DESIGN.md` — plugin design (types, state, extension lifecycle)
-- `DESIGN-long-running-supervision.md` — v0.36.0 event/progress-driven supervision, aggressive recovery, terminal recaps, and future decision checklist
-- `GLLA-POSITIONING-AND-DECOMPOSITION-2026-08-08.md` — ecosystem
+- `DESIGN.md`: plugin design (types, state, extension lifecycle)
+- `DESIGN-long-running-supervision.md`: v0.36.0 event/progress-driven supervision, aggressive recovery, terminal recaps, and future decision checklist
+- `GLLA-POSITIONING-AND-DECOMPOSITION-2026-08-08.md`: ecosystem
   positioning, competitor review, and the goal.ts decomposition plan
-  (the current strategic doc — read this before touching
+  (the current strategic doc; read this before touching
   `extensions/loops/goal.ts`)
-- `VISION-ASSIST.md` — vision-assist plugin notes
-- `RELEASING.md` — how to publish to npm
+- `VISION-ASSIST.md`: vision-assist plugin notes
+- `RELEASING.md`: how to publish to npm
 
 ## Supporting material
-- `../prompts/` — goal/loop drafting prompt templates
-- `../schemas/` — goal state JSON schema
-- `../examples/` — example objective files
-- `../CHANGELOG.md` — user-facing changelog (unreleased at top)
-- `/glla bug` — `extensions/goal-commands.ts:cmdGllaBug` captures failure context to `<stateDir>/bugs/<ts>-<id>.md` without touching `active.jsonl`/`goals/*.md` (see `tests/glla-bug-capture.test.ts`)
+- `../prompts/`: goal/loop drafting prompt templates
+- `../schemas/`: goal state JSON schema
+- `../examples/`: example objective files
+- `../CHANGELOG.md`: user-facing changelog (unreleased at top)
+- `/glla bug`: `extensions/goal-commands.ts:cmdGllaBug` captures failure context to `<stateDir>/bugs/<ts>-<id>.md` without touching `active.jsonl`/`goals/*.md` (see `tests/glla-bug-capture.test.ts`)
 
 ## Repository-only material
 The audit history and competitor research live in `audit/` and `.research/`
 for contributors, but are intentionally not included in the npm tarball.
 
 ## Research material
-`.research/` — competitor plugin sources pulled from npm tarballs for study
+`.research/`: competitor plugin sources pulled from npm tarballs for study
 (gitignored, local only). Re-pull with `cd .research && npm pack <pkg> &&
 tar xzf <tgz>`; see the positioning doc's appendix for the package list.

package/extensions/goal-continuation.ts

@@ -56,6 +56,7 @@ import {
   type ObjectiveRepairTarget,
 } from "./goal-loop-core.js";
 import { auditorSurfaceSuppressed } from "./loops/goal-auditor-surface.js";
+import { assemblePrompt } from "./prompt-layers.js";
 import {
   createContinuationDispatch,
   transitionDispatch,
@@ -1235,7 +1236,7 @@ export function buildContinuationContent(goal: Goal, opts: { resync?: string; fi
   const resync = opts.resync ?? "";
   const marker = buildMarkerContent(goal.id);
   const needsFull = (opts.firstSend ?? false) || needsFullContinuation(goal);
-  if (needsFull) return { content: resync + continuationPrompt(goal), kind: resync ? "full+resync" : "full" };
+  if (needsFull) return { content: resync + continuationPrompt(goal, { includeRestartDetail: Boolean(resync) || Boolean(goal.autoResumedAt) }), kind: resync ? "full+resync" : "full" };
   if (resync) return { content: resync + marker, kind: "resync" };
   return { content: marker, kind: "marker" };
 }
@@ -1493,7 +1494,7 @@ export function buildPostCompactResync(briefExcerpt?: string): string {
   return lines.join("\n") + "\n\n";
 }
 
-export function continuationPrompt(goal: Goal): string {
+export function continuationPrompt(goal: Goal, opts: { includeRestartDetail?: boolean } = {}): string {
   // Read the .md file as the template, then substitute {{tokens}}.
   // For v0.1.0 we inline-substitute so we don't need fs at runtime.
   const next = findNextPendingTask(goal.taskList?.tasks ?? []);
@@ -1503,13 +1504,17 @@ export function continuationPrompt(goal: Goal): string {
   const taskSummary = goal.taskList?.tasks.length
     ? buildTaskSummary(goal.taskList.tasks)
     : "(no task list)";
-  const tmplPath = path.resolve(__dirname, "..", "prompts", "goal-loop-continuation.md");
-  let tmpl: string;
-  try {
-    tmpl = fs.readFileSync(tmplPath, "utf-8");
-  } catch {
-    tmpl = "[template-not-found]";
-  }
+  // Layered assembly: skeleton always; details only when their trigger is
+  // already known at render time. Static layers resolve before dynamic
+  // ${...} substitution, in file order every turn. Mid-turn contingencies
+  // (subagent death, provider errors, detached commits, stalls, task
+  // workflow) stay in the skeleton: their trigger cannot be known before
+  // the turn, and there is no mid-turn detail fetch.
+  const detailIds = new Set<string>();
+  if (liveDisapproval(goal.auditHistory ?? [])) detailIds.add("auditor-disapproval");
+  if (isFullAuditObjective(goal.objective)) detailIds.add("survey-pivot");
+  if (opts.includeRestartDetail || goal.autoResumedAt) detailIds.add("session-restart");
+  const tmpl = assemblePrompt("goal-loop-continuation.md", detailIds);
   // v0.25.0 (contract items 22/28): conditional directives — aggressiveMode
   // TODOs from the audit cap, and the full-audit fan-out directive when the
   // objective reads as a survey pivot. The canonical judgment policy and

package/extensions/goal-loop.ts

@@ -26,6 +26,7 @@ import {
   supervisorPaused,
 } from "./goal-loop-core.js";
 import { BACKOFF_IDLE_RETRY_MS, MEASURE_TIMEOUT_MS } from "./goal-loop-backoff.js";
+import { loadPromptWhole } from "./prompt-layers.js";
 import {
   REPETITION,
   continueVariant,
@@ -285,15 +286,7 @@ function loopPrompt(loop: LoopState, regressionNote: string, strategyNote: strin
   // v0.23.0: metricless loops get their own prompt — no metric section,
   // anti-doorknob rules instead of anti-gaming rules.
   const metricless = !loop.measureCmd;
-  const tmplPath = path.resolve(__dirname, "..", "..", "prompts", metricless ? "goal-loop-forever-metricless.md" : "goal-loop-forever.md");
-  let tmpl: string;
-  try {
-    tmpl = fs.readFileSync(tmplPath, "utf-8");
-  } catch {
-    tmpl = metricless
-      ? `[LOOP ITERATION ${loop.iteration + 1}] Target: ${loop.target}. Metricless spec loop — make ONE real, inspectable change advancing the target. No cosmetic churn. ${variantNote} ${interventionNote}`
-      : `[LOOP ITERATION ${loop.iteration + 1}] Target: ${loop.target}. Measure: ${loop.measureCmd} (${loop.direction}). Make ONE small change to improve the metric. ${interventionNote}`;
-  }
+  const tmpl = loadPromptWhole(metricless ? "goal-loop-forever-metricless.md" : "goal-loop-forever.md");
   return tmpl
     .replace(/\$\{ITERATION\}/g, String(loop.iteration + 1))
     .replace(/\$\{TARGET\}/g, loop.target)

package/extensions/loops/goal-list-queue.ts

@@ -26,6 +26,7 @@ import { Type } from "typebox";
 // (positioning doc invariant #2). Property reads on the imported binding are
 // fine; wholesale replacement goes through replaceState().
 import { state, replaceState, persistStateLine } from "../goal-state.js";
+import { loadPromptWhole } from "../prompt-layers.js";
 
 import {
   type Goal,
@@ -863,11 +864,9 @@ async function startDrafting(ctx: ExtensionContext, target: "goal" | "list" | "l
       : target === "loop"
         ? `${label}: a loop target needs a metric and a direction — the agent will help you design them first (nothing activates until you confirm). Skip the interview entirely: /loop start "<target>" (bare = infinite metricless) or /loop start "<target>" measure="<cmd>" direction=min|max [window=5] [max=50] [time=h] [tokens=n] [branch=1].`
         : `${label}: the objective has no "Done when:" clause — the agent will grill you about it first (nothing activates until you confirm). Skip the interview entirely: /goal start <objective>.`);
-  const tmplPath = path.resolve(__dirname, "..", "..", "prompts", file);
-  let tmpl: string;
-  try {
-    tmpl = fs.readFileSync(tmplPath, "utf-8");
-    if (target === "list") {
+  // Layered-prompt contract: a missing draft file fails loudly — never render lean.
+  let tmpl = loadPromptWhole(file);
+  if (target === "list") {
       tmpl = tmpl.replace(
         "[GOAL DRAFTING]",
         "[LIST DRAFTING — the confirmed item goes into the /list LIST, it does not activate immediately. " +
@@ -880,9 +879,6 @@ async function startDrafting(ctx: ExtensionContext, target: "goal" | "list" | "l
           "is still a SHORT task — never an aggregate wrapper ('land all N findings' with a '≥N commits' contract is the " +
           "canonical anti-pattern: the auto-committer squashes, the count fails, the auditor disapproves finished work).]",
       );
-    }
-  } catch {
-    tmpl = `[DRAFTING] Clarify the user's ${target}, then call ${tool}.`;
   }
   // v0.14.0: the LLM grills (its strength — v0.13.0's canned questionnaire
   // accepted non-answers), the plugin enforces the floor: propose_goal_draft

package/extensions/prompt-layers.ts

@@ -0,0 +1,145 @@
+// ============================================================================
+// prompt-layers.ts — static skeleton + on-demand detail assembly for prompts/
+// ============================================================================
+// Every prompts/*.md file is one canonical, editor-renderable document.
+// Detail sections are wrapped in zero-width structural markers:
+//
+//   <!-- glla-layer: detail <id> -->
+//   ...section body, untouched...
+//   <!-- glla-layer: end -->
+//
+// Everything outside a detail block is the skeleton: always loaded.
+// A detail block loads only when its phase predicate holds. Assembly order
+// is file order, every turn — static layers resolve before dynamic
+// ${...} substitution slots, so renders are deterministic.
+//
+// Loudness contract: any structural problem (missing file, unclosed block,
+// duplicate id, end-without-start, unknown requested id) THROWS naming the
+// file. A render never proceeds lean on a "[template-not-found]" fallback.
+// Marker lines are structural only and are stripped from assembled output,
+// so full assembly (every detail active) is byte-identical to the source
+// file minus its marker lines.
+// ============================================================================
+
+import * as fs from "node:fs";
+import * as path from "node:path";
+
+const LAYER_START_RE = /^\s*<!--\s*glla-layer:\s*detail\s+([A-Za-z0-9_-]+)\s*-->\s*$/;
+const LAYER_END_RE = /^\s*<!--\s*glla-layer:\s*end\s*-->\s*$/;
+
+export interface PromptSegment {
+  kind: "skeleton" | "detail";
+  /** Present only for detail segments. */
+  id?: string;
+  /** Exact source lines for this segment (marker lines excluded). */
+  lines: string[];
+}
+
+export function promptFilePath(name: string): string {
+  return path.resolve(__dirname, "..", "prompts", name);
+}
+
+/** Parse one prompt source into ordered segments. Throws naming the file
+ * on any structural defect. Pure (no fs) so tests can feed fixtures. */
+export function parsePromptLayers(source: string, name: string): PromptSegment[] {
+  const segments: PromptSegment[] = [];
+  let current: PromptSegment = { kind: "skeleton", lines: [] };
+  let openId: string | null = null;
+  const seen = new Set<string>();
+  const fail = (why: string): never => {
+    throw new Error(`[glla] prompts/${name}: ${why}`);
+  };
+  for (const line of source.split("\n")) {
+    const start = line.match(LAYER_START_RE);
+    const end = LAYER_END_RE.test(line);
+    if (start) {
+      if (openId !== null) fail(`detail "${openId}" unclosed before detail "${start[1]}" starts`);
+      const id = start[1] as string;
+      if (seen.has(id)) fail(`duplicate detail id "${id}"`);
+      seen.add(id);
+      segments.push(current);
+      current = { kind: "detail", id, lines: [] };
+      openId = id;
+      continue;
+    }
+    if (end) {
+      if (openId === null) fail("glla-layer end marker without an open detail block");
+      segments.push(current);
+      current = { kind: "skeleton", lines: [] };
+      openId = null;
+      continue;
+    }
+    current.lines.push(line);
+  }
+  if (openId !== null) fail(`detail "${openId}" unclosed at end of file`);
+  segments.push(current);
+  return segments;
+}
+
+/** Read + parse a prompt file. Throws naming the path when unreadable. */
+export function loadPromptSegments(name: string): PromptSegment[] {
+  const file = promptFilePath(name);
+  let source: string;
+  try {
+    source = fs.readFileSync(file, "utf-8");
+  } catch (err) {
+    throw new Error(
+      `[glla] prompt file missing: prompts/${name} (${file}): ${(err as Error)?.message ?? err}. ` +
+        "Refusing to render lean — restore the file, do not proceed without it.",
+    );
+  }
+  return parsePromptLayers(source, name);
+}
+
+/** Raw whole-file read. Throws (loud) when unreadable. Use for
+ * skeleton-only phases and for render-diff baselines. */
+export function loadPromptWhole(name: string): string {
+  const file = promptFilePath(name);
+  try {
+    return fs.readFileSync(file, "utf-8");
+  } catch (err) {
+    throw new Error(
+      `[glla] prompt file missing: prompts/${name} (${file}): ${(err as Error)?.message ?? err}. ` +
+        "Refusing to render lean — restore the file, do not proceed without it.",
+    );
+  }
+}
+
+/** Detail ids declared by a prompt file, in file order. */
+export function promptDetailIds(name: string): string[] {
+  const ids: string[] = [];
+  for (const seg of loadPromptSegments(name)) {
+    if (seg.kind === "detail" && seg.id) ids.push(seg.id);
+  }
+  return ids;
+}
+
+/** Assemble skeleton + the requested details in file order. Unknown ids
+ * throw. Empty `active` renders the bare skeleton. */
+export function assemblePrompt(name: string, active: Iterable<string>): string {
+  const segments = loadPromptSegments(name);
+  const want = new Set(active);
+  const known = new Set<string>();
+  for (const seg of segments) {
+    if (seg.kind === "detail" && seg.id) known.add(seg.id);
+  }
+  for (const id of want) {
+    if (!known.has(id)) {
+      throw new Error(
+        `[glla] prompts/${name}: unknown detail id "${id}" (known: ${[...known].join(", ") || "(none)"}). ` +
+          "Refusing to render lean — fix the request, do not proceed without it.",
+      );
+    }
+  }
+  const out: string[] = [];
+  for (const seg of segments) {
+    if (seg.kind === "skeleton" || (seg.id && want.has(seg.id))) out.push(...seg.lines);
+  }
+  return out.join("\n");
+}
+
+/** Full assembly: every declared detail active. Render-diff gate: this must
+ * equal the source file minus its marker lines. */
+export function assemblePromptFull(name: string): string {
+  return assemblePrompt(name, promptDetailIds(name));
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-goal-list-loop-audit",
-  "version": "0.38.46",
+  "version": "0.38.47",
   "description": "Mission control for autonomous pi: interview-drafted goals, an audited task queue, and forever-loops (metric, spec, project-audit) that run for hours. A detached extension-less auditor process re-verifies every completion with raw evidence without holding the main pi turn; confirmed drafts, decision pauses and consent gates keep you in charge.",
   "license": "AGPL-3.0-only",
   "author": "dracon",

package/prompts/goal-loop-continuation.md

@@ -77,6 +77,7 @@ When the agent calls any of these, the orchestrator tracks the call and persists
 - **Bound every long command.** Wrap test suites, builds, and dev servers in `timeout <seconds>` (e.g. `timeout 120 bun test src/lib`). An unbounded command that hangs burns an hour; a bounded one burns two minutes and tells you it hung. If a command produces no output for many minutes, treat it as hung: kill it, diagnose why, rerun bounded.
 - **Chunk output near context-full & microcompaction.** When the conversation is heavy (long-running audit, deep debug, big rollout), prefer smaller commits, smaller tool outputs, and focused reasoning — one or two punchy paragraphs, one well-scoped tool call at a time. Don't try to fit a thousand lines of work into one reply. Spool massive stdout/diffs to disk logs if needed. glla's auto-continue fires on `stop_reason="length"` and will reschedule you; chunking is cheaper than recovering from the cap. Save large file writes for their own turns.
 
+<!-- glla-layer: detail auditor-disapproval -->
 ## WHEN THE AUDITOR DISAPPROVES
 
 If the orchestrator tells you the auditor disapproved, **investigate before asking the user**:
@@ -90,7 +91,9 @@ If the orchestrator tells you the auditor disapproved, **investigate before aski
    "The auditor's last 3 reports all complain about saves-3 not shipping. The current objective IS saves-3, but the work shipped is menu-3 + kingdom-2 (different items). I shipped those because [reason]. The auditor is disapproving because the original objective isn't literally shipped. Three options: A. /goal tweak the objective to menu-3+kingdom-2, then /goal resume — B. Re-scope saves-3 and ship it — C. Pivot to a different item entirely."
 
 Do NOT ask the user to choose between generic options like "/goal resume / Move on silently / Different item". Those options tell the user nothing. Always include YOUR ASSESSMENT with quoted objections and shipped evidence.
+<!-- glla-layer: end -->
 
+<!-- glla-layer: detail survey-pivot -->
 ## PIVOT DETECTION
 
 When the user says "do a full audit", "survey the project", "find all problems", "mark a tasklist", or similar — the goal is a SURVEY, not a single fix. You must:
@@ -100,6 +103,7 @@ When the user says "do a full audit", "survey the project", "find all problems",
 3. Use subagents to PARALLEL-survey different subsystems (game logic, UI, audio, tests, docs) — one `scout` agent per subsystem, spawned in a single message.
 4. Don't ship a single bug fix and then ask if the user wants to continue — the user already said "do a full audit".
 5. After the task list is confirmed, work through tasks systematically with `complete_task` / `update_task_status`.
+<!-- glla-layer: end -->
 
 ## WHEN SUBAGENTS DIE: RESUME, DON'T RESPAWN
 
@@ -108,9 +112,11 @@ A failed subagent's SESSION survives its death (verified in pi-subagents source:
 1. **Resume it immediately**: `Agent(resume: "<id>", prompt: "Wrap up now: report what you found within ~150 lines.")`. A resumed agent already HAS its research; it only needs to report. Do not infer a reset time from the error text.
 2. **Resume failed with "not found"?** The manager forgot it (a /reload wipes the in-process registry — old IDs are unresumable). Only NOW respawn, and never the same wide brief: SPLIT into 2 narrower agents or ABSORB the remainder inline.
 
+<!-- glla-layer: detail session-restart -->
 ## AFTER A SESSION RESTART: YOUR SUBAGENTS ARE DEAD
 
 Subagents run IN-PROCESS — a /reload or restart kills every running one instantly and silently (no failure event, no ✗), and their IDs become unresumable. On a restored session, check your transcript for in-flight agents and relaunch them (tight briefs) or absorb their scope — do NOT sit waiting for results that can never arrive. This is why long fan-out passes belong under a glla goal/list item: the goal plane survives restarts and re-drives the fan-out through the continuation; an ad-hoc fan-out dies with the tab.
+<!-- glla-layer: end -->
 
 ## WHEN SUBAGENTS HIT PROVIDER/RUNTIME ERRORS