pi-goal-list-loop-audit 0.38.47 → 0.38.49

package/CHANGELOG.md

@@ -1,5 +1,57 @@
 # Changelog
 
+## 0.38.49 — audit-pass drift fixes: prompt gate, summary segmentation, task honesty (2026-09-11)
+
+Full-project audit pass on v0.38.48 (three parallel scout surveys). Six new
+findings, all fixed on main; scout claims that were unproven, stale, or
+by-design are disposed with rationale in the pass note, not as findings.
+
+### Fixed
+
+- **Continuation prompt drift:** the Available-tools list and task workflow
+  now name `update_task_batch` (validate whole, verify milestones, persist
+  once) and the pending-task completion gate (`complete_goal` refused
+  before audit while committed tasks are open; `record_goal_judgment`
+  `choice=deferred` + `taskId` exempts a blocked item). Completion-voice
+guidance matches the rich-section renderer budgets.
+- **README verify path:** the `complete_goal` steps now include the
+  pending-task refusal before audit.
+- **Docs versions/voice:** INSTALL updating examples show the current
+  versions; the supervision design doc distinguishes the verbatim six-label
+  archive record from the rich chat/transcript sections and the compact
+  width-bound projection.
+- **Summary gate segmentation:** `missingCompletionSummaryLabels` segments
+  on the same last-occurrence positions as every projector, so a label
+  named inside an earlier value can no longer pass the gate while rendering
+  shifted (removed the now-dead `labelIndex`).
+- **Task-tool honesty:** completing an already-complete task reports
+  `Task <id> is already complete.` and same-status `update_task_status`
+  moves report `already <status>` instead of the not-found fallthrough or
+a no-op persist.
+- **Sidecar pending boundary:** the approval-render outbox and the
+  update-check refresh defer while sessionDir resolution is pending instead
+  of creating (or latching degraded on) a `<cwd>/.pi-glla` fallback tree.
+
+### Tests
+
+- Re-baselined `tests/context-growth-measurement.test.ts` to 22_570 chars
+  / 22_670 bytes per payload (+769 chars incl. one em dash) with exact
+  multiples preserved across probe sizes. New pins: stolen-label gate
+  agreement, already-complete/no-op task messages, sidecar pending deferral.
+  `tsc` clean.
+
+## 0.38.48 — atomic task batches + pending-task completion gate (2026-09-11)
+
+### Added
+
+- **update_task_batch tool:** validate whole → verify every `complete` milestone's `verificationContract` → copy + apply → persist once. A rejected batch or a mid-batch milestone failure leaves state untouched.
+- **Pending-task completion gate:** `complete_goal` with open committed tasks is refused BEFORE the auditor, naming each open item (`- <id>: "<title>" (<status>)`) with a `complete_goal_tasks_refused` ledger entry. Refusal mutates nothing and cannot be bypassed via `newObjective` (gate sits before the pivot branch).
+- **Deferral exemption:** `record_goal_judgment` accepts `taskId` only with `choice=deferred`; stamps `task.deferred = { reason, followUp, at }` in the same persist as the ledger entry. `inline` + `taskId` and unknown ids are refused with no ledger change.
+
+### Tests
+
+- `tests/task-atomicity-gate.test.ts`: 7 pure-core + 10 MockPi pins (mid-batch kill untouched, refusal names each task, deferral pass-through). `tsc` clean.
+
 ## 0.38.47 — layered prompts: skeleton plus on-demand detail (2026-09-11)
 
 ### Changed

package/INSTALL.md

@@ -31,11 +31,11 @@ GLLA loads into new pi sessions. If pi is already open, reload that session:
 
 ## Updating
 
-The status line always shows the running version (`glla: … · v0.38.46`).
+The status line always shows the running version (`glla: … · v0.38.48`).
 When the npm registry is ahead, it also nudges:
 
 ```text
-glla: … · v0.38.45 · update v0.38.46 available
+glla: … · v0.38.47 · update v0.38.48 available
 ```
 
 The nudge comes from a daily sidecar check (`.pi-glla/update-check.json`),

package/README.md

@@ -250,12 +250,14 @@ When the agent calls `complete_goal`, GLLA:
 
 1. runs the contract's mechanical checks when a release or command check is
    specified;
-2. writes an identity-bound completion claim;
-3. starts a detached, fresh pi RPC worker for the audit;
-4. asks the worker to inspect the repository and run bounded checks;
-5. requires raw evidence for each verification-contract item through the
+2. refuses the claim before audit when committed tasks are still open
+   (tasks with a recorded deferral are exempt), naming each open task;
+3. writes an identity-bound completion claim;
+4. starts a detached, fresh pi RPC worker for the audit;
+5. asks the worker to inspect the repository and run bounded checks;
+6. requires raw evidence for each verification-contract item through the
    orchestrator-side regression shield;
-6. keeps the goal open on infrastructure failure, missing evidence, or
+7. keeps the goal open on infrastructure failure, missing evidence, or
    disapproval instead of silently archiving it.
 
 The auditor is intentionally isolated from the implementing conversation and

package/docs/DESIGN-long-running-supervision.md

@@ -110,10 +110,15 @@ status/reason, durable telemetry, captured audit verdicts, and known archive
 path. It says `not recorded` when a changed-file manifest or test result is not
 available. It never infers a passing test or invents a commit.
 
-The full recap lives in the archive and status/history surfaces. Every
-terminal goal notification—including version-bearing already-shipped claims,
-explicit goal/list cancellation, and `/glla wipe`—includes a compact
-projection of all six labels; loop notifications do the same. The terminal
+The full six-label recap lives verbatim in the archive (`## Completion summary`)
+and the status/history surfaces. The human layer in chat, transcript, and the
+archive's `## Terminal summary` renders the same facts as rich sections
+(`## Done`, Key Findings, Verification Summary table, Next, capped and clipped
+to fixed budgets). Width-bound and external surfaces (status line, widget card,
+external notifies) use the compact single-line projection of all six labels.
+Every terminal goal notification, including version-bearing already-shipped claims,
+explicit goal/list cancellation, and `/glla wipe`, carries either the rich sections
+or the compact projection; loop notifications do the same. The terminal
 notification may use a compact excerpt. The executor recap and independent
 auditor verdict stay separate: an approval is not manufactured from the
 presence of a summary.

package/docs/INDEX.md

@@ -16,7 +16,7 @@ Policy contracts and recent changes live in the `audit/` directory of the
   failback; v0.35.9 hardened cross-version npm tarball checks; v0.35.10
   handles multi-entry npm dry-run reports; v0.35.11 accepts both npm report
   shapes; v0.35.12 supports npm 12's keyed pack reports; v0.35.13 fixes stale-API recovery loops.
-  v0.35.14–v0.38.47 continue through the supervisor freeze (`/glla pause`),
+  v0.35.14–v0.38.49 continue through the supervisor freeze (`/glla pause`),
   load hold, auditor picker parity, Windows launch fix, zombie-watchdog
   subagent carve-out, due-wait backstop, the `/glla agents` visibility panel,
   durable state-root selection, blank-until-resume auditor context, frozen

package/extensions/approval-render-store.ts

@@ -1,6 +1,7 @@
 import * as fs from "node:fs";
 import * as path from "node:path";
 import { appendLedger, ensureDirs, nowIso, piGlaDir, runPersistStep } from "./goal-loop-core.js";
+import { stateRootPending } from "./glla-state-root.js";
 
 /** Durable terminal-summary outbox. A toast or a live host is not delivery:
  * only a confirmed visible session message acknowledges a render. */
@@ -67,6 +68,9 @@ function readRenders(cwd: string): PendingApprovalRender[] {
 }
 
 function writeRenders(cwd: string, renders: PendingApprovalRender[]): boolean {
+  // v0.38.49 audit: pending sessionDir resolution defers every write that
+  // would otherwise recreate <cwd>/.pi-glla — the sidecar is no exception.
+  if (stateRootPending()) return false;
   const landed = runPersistStep("persistApprovalRender", () => {
     ensureDirs(cwd);
     const file = approvalRenderStorePath(cwd);

package/extensions/completion-summary.ts

@@ -31,10 +31,6 @@ export interface CompletionSummaryFacts {
   archivePath?: string;
 }
 
-function labelIndex(text: string, label: CompletionSummaryLabel): number {
-  return text.toLowerCase().indexOf(label.toLowerCase());
-}
-
 /**
  * Validation/version annotations are metadata, not recap fields. Keep them
  * out of the parser so a generated NOTE containing examples such as
@@ -45,17 +41,20 @@ function completionSummaryBody(text: string): string {
   return annotation?.index === undefined ? text : text.slice(0, annotation.index);
 }
 
-/** Return labels that are absent or have no value after the label. */
+/** Return labels that are absent or have no value after the label. Segments on
+ * the same last-occurrence positions as every projector (compact, multi-line,
+ * rich): a label named inside an earlier value must not shift the gate away
+ * from what the user will actually read. */
 export function missingCompletionSummaryLabels(text: string): CompletionSummaryLabel[] {
   const normalized = completionSummaryBody(text).trim();
+  const positions = labelPositions(normalized.toLowerCase());
   return COMPLETION_SUMMARY_LABELS.filter((label) => {
-    const start = labelIndex(normalized, label);
-    if (start < 0) return true;
-    const valueStart = start + label.length;
-    const next = COMPLETION_SUMMARY_LABELS
-      .map((candidate) => labelIndex(normalized.slice(valueStart), candidate))
-      .filter((index) => index >= 0)
-      .map((index) => valueStart + index)
+    const current = positions.find((entry) => entry.label === label);
+    if (!current) return true;
+    const valueStart = current.start + label.length;
+    const next = positions
+      .filter((entry) => entry.start > current.start)
+      .map((entry) => entry.start)
       .sort((a, b) => a - b)[0];
     return normalized.slice(valueStart, next ?? normalized.length).trim().length === 0;
   });

package/extensions/glla-update-check.ts

@@ -1,6 +1,7 @@
 import { spawn } from "node:child_process";
 import * as fs from "node:fs";
 import * as path from "node:path";
+import { stateRootPending } from "./glla-state-root.js";
 import {
   compareVersions,
   GLLA_PACKAGE_NAME,
@@ -60,6 +61,10 @@ export function refreshUpdateCheck(
   now = Date.now(),
   spawnFn: SpawnFn = spawn as unknown as SpawnFn,
 ): void {
+  // v0.38.49 audit: while sessionDir resolution is pending there is no
+  // session root yet — skip the refresh (and its cache write) instead of
+  // creating a <cwd>/.pi-glla fallback tree.
+  if (stateRootPending()) return;
   try {
     const cached = readUpdateCheckRaw(cwd);
     if (cached && now - cached.checkedAt < UPDATE_CHECK_TTL_MS) return;

package/extensions/goal-loop-core.ts

@@ -97,6 +97,15 @@ export function workCommand(mode: Policy | "loop" | undefined, command: string):
   return `${workCommandRoot(mode)} ${command}`;
 }
 
+export interface TaskDeferral {
+  /** Why the durable action is unsafe, impossible, or blocked right now. */
+  reason: string;
+  /** The bounded durable follow-up. */
+  followUp: string;
+  /** ISO timestamp of the recorded judgment. */
+  at: string;
+}
+
 export interface Task {
   id: string;
   title: string;
@@ -106,6 +115,11 @@ export interface Task {
   /** Optional verification gate for milestone-checked tasks. */
   verificationContract?: string;
   subtasks?: Task[];
+  /** A recorded deferral (via record_goal_judgment choice=deferred + taskId)
+   * exempts this task from the complete_goal pending-task gate. The
+   * exemption is durable state, not prose: the ledger holds the judgment,
+   * this stamp is the gate-readable pointer. */
+  deferred?: TaskDeferral;
 }
 
 export interface TaskList {

package/extensions/loops/goal-tools.ts

@@ -134,6 +134,16 @@ isGoalRevisionCurrent,
   buildDurableChoiceRecord,
   normalizeDurableDeferRecommendationInput,
 } from "../goal-loop-core.js";
+import {
+  applyValidatedBatch,
+  collectOpenTasks,
+  findTask,
+  formatOpenTaskRefusal,
+  patchTaskCopy,
+  validateTaskBatch,
+  withTaskStatus,
+  type TaskStatusUpdate,
+} from "../task-batch.js";
 import {
   createContinuationDispatch,
   dispatchMatchesOwner,
@@ -556,6 +566,22 @@ function registerAgentTools(pi: any): void {
           details: {},
         };
       }
+      // v0.38.48: pending-task completion gate — a claim with open
+      // committed tasks is refused BEFORE the auditor, naming each open
+      // item. Tasks carrying a recorded deferral (record_goal_judgment
+      // choice=deferred + taskId) are exempt. Placed before newObjective:
+      // a pivot must not silently orphan committed tasks — finish them or
+      // defer them explicitly first. Refusal mutates nothing.
+      if (state.goal.taskList) {
+        const openTasks = collectOpenTasks(state.goal.taskList);
+        if (openTasks.length > 0) {
+          appendLedger(ctx.cwd, "complete_goal_tasks_refused", {
+            goalId: state.goal.id,
+            open: openTasks.map((t) => ({ id: t.id, title: t.title, status: t.status })),
+          });
+          return { content: [{ type: "text", text: formatOpenTaskRefusal(openTasks) }], details: {} };
+        }
+      }
       // v0.25.0 (contract item 15): atomic objective update + audit in one
       // call — the objective-drift disapprove loop (ship shifted work →
       // auditor disapproves the ORIGINAL objective) ends here. Ledgered so
@@ -1913,6 +1939,7 @@ function registerAgentTools(pi: any): void {
       durableFix: Type.Optional(Type.String({ maxLength: 500, description: "The maintainable root-cause action to show in the goal card" })),
       deferRecommendations: Type.Optional(Type.Array(Type.String({ maxLength: 500 }), { maxItems: 8, description: "Earlier bounded workaround/defer recommendations to retain as UI evidence" })),
       durableBlocked: Type.Optional(Type.Boolean({ description: "True only when the durable action is unsafe, impossible, or blocked for this turn" })),
+      taskId: Type.Optional(Type.String({ description: "v0.38.48: with choice=deferred, attach this deferral to a task so the complete_goal pending-task gate exempts it. Only valid with choice=deferred." })),
     }),
     async execute(_id, params, signal, _onUpdate, execCtx) {
       const foreignJudgment = foreignToolGuard(execCtx);
@@ -1930,7 +1957,20 @@ function registerAgentTools(pi: any): void {
         durableFix?: string;
         deferRecommendations?: string[];
         durableBlocked?: boolean;
+        taskId?: string;
       };
+      // v0.38.48: a task-linked deferral exempts that task from the
+      // complete_goal pending-task gate. Inline needs no exemption (the fix
+      // ships now); an unknown task is refused before anything is recorded.
+      const taskId = p.taskId?.trim() || undefined;
+      if (taskId && p.choice !== "deferred") {
+        return { content: [{ type: "text", text: "taskId is only valid with choice=deferred — an inline judgment implements the fix now and needs no task exemption. Nothing was recorded." }], details: {} };
+      }
+      const goal = state.goal;
+      const deferredTask = taskId ? (goal.taskList ? findTask(goal.taskList, taskId) : null) : undefined;
+      if (taskId && !deferredTask) {
+        return { content: [{ type: "text", text: `No task "${taskId}" in this goal's task list — the judgment was NOT recorded.` }], details: {} };
+      }
       const record = buildDurableChoiceRecord(p.choice, p.reason, p.followUp);
       if (!record.reason) {
         return { content: [{ type: "text", text: "A non-empty reason is required to record a durable-vs-defer judgment." }], details: {} };
@@ -1938,19 +1978,30 @@ function registerAgentTools(pi: any): void {
       if (record.choice === "deferred" && !record.followUp) {
         return { content: [{ type: "text", text: "A deferred judgment also requires a durable follow-up." }], details: {} };
       }
-      const goal = state.goal;
       const durableDeferRecommendation = durableDeferFactsForGoal(goal, record, p);
       const landed = appendLedger(ctx.cwd, "durable_defer_choice", {
         goalId: goal.id,
         ...record,
+        ...(taskId ? { taskId, taskTitle: deferredTask!.title } : {}),
         durableDeferRecommendation,
       });
       if (!landed) {
         return { content: [{ type: "text", text: "The durable-vs-defer judgment could not be persisted; no choice was recorded." }], details: {} };
       }
-      if (!updateGoal({ durableDeferRecommendation }, ctx)) {
+      // v0.38.48: the task stamp rides the SAME persist as the UI
+      // projection — one write, never a stamped-but-unprojected split.
+      // record.followUp is proven non-empty for deferred above; a taskId
+      // always implies deferred (refused otherwise), so the non-null
+      // assertion holds exactly when a stamp is written.
+      const patch: Record<string, unknown> = { durableDeferRecommendation };
+      if (taskId && goal.taskList) {
+        patch.taskList = patchTaskCopy(goal.taskList, taskId, {
+          deferred: { reason: record.reason, followUp: record.followUp!, at: nowIso() },
+        });
+      }
+      if (!updateGoal(patch as Parameters<typeof updateGoal>[0], ctx)) {
         return {
-          content: [{ type: "text", text: `Recorded durable-vs-defer judgment: ${record.choice}, but its UI recommendation projection could not be persisted.` }],
+          content: [{ type: "text", text: `Recorded durable-vs-defer judgment: ${record.choice} in the ledger, but its persistence failed${taskId ? " — the task exemption did NOT land, so the gate will still block" : ""}. Retry.` }],
           details: {},
         };
       }
@@ -1959,7 +2010,7 @@ function registerAgentTools(pi: any): void {
       // from the state ledger through Goal.durableDeferRecommendation.
       refreshUI(ctx, true);
       return {
-        content: [{ type: "text", text: `Recorded durable-vs-defer judgment: ${record.choice}.` }],
+        content: [{ type: "text", text: `Recorded durable-vs-defer judgment: ${record.choice}.${taskId ? ` Task ${taskId} ("${deferredTask!.title}") is now exempt from the complete_goal pending-task gate.` : ""}` }],
         details: {},
       };
     },
@@ -2160,71 +2211,133 @@ function registerAgentTools(pi: any): void {
         return { content: [{ type: "text", text: "No task list in this goal." }], details: {} };
       }
       const tl = state.goal.taskList;
-      const queue: any[] = [...tl.tasks];
-      while (queue.length > 0) {
-        const t = queue.shift();
-        if (t.id === p.id && t.status !== "complete") {
+      // v0.38.48: copy-swap — the live list is never mutated in place, so a
+      // kill between verify and persist (or a persist failure) cannot leave
+      // partial state. Message strings are pinned by
+      // tests/task-atomicity-gate.test.ts.
+      const t = findTask(tl, p.id);
+      if (!t) return { content: [{ type: "text", text: `Task ${p.id} not found.` }], details: {} };
+      // v0.38.49 audit: an existing but already-complete task is a state
+      // fact, not a typo — report it instead of the not-found fallthrough.
+      if (t.status === "complete") return { content: [{ type: "text", text: `Task ${p.id} is already complete.` }], details: {} };
+      if (t) {
+        const checkRes = await verifyTaskMilestone(ctx, t.verificationContract, signal);
+        if (checkRes) {
+          return {
+            content: [{
+              type: "text",
+              text: `Task ${p.id} milestone verification FAILED for command \`${checkRes.failedCommand}\` (exit code ${checkRes.exitCode}):\n\n${checkRes.output}\n\nTask ${p.id} remains in_progress. Fix the failure before marking complete.`,
+            }],
+            details: {},
+          };
+        }
+        if (!updateGoal({ taskList: withTaskStatus(tl, p.id, "complete") }, ctx)) {
+          return { content: [{ type: "text", text: `Task ${p.id} could not be marked complete — the persist failed and no state changed. Retry.` }], details: {} };
+        }
+        return { content: [{ type: "text", text: `Task ${p.id} marked complete.` }], details: {} };
+      }
+    },
+  }));
+
+  pi.registerTool(defineTool({
+    name: "update_task_status",
+    label: "Update task status",
+    description: "Update a task's status (pending/in_progress/complete).",
+    parameters: Type.Object({
+      id: Type.String(),
+      status: Type.Union([Type.Literal("pending"), Type.Literal("in_progress"), Type.Literal("complete")]),
+    }),
+    async execute(_id, params, signal, _onUpdate, execCtx) {
+      const foreign8 = foreignToolGuard(execCtx);
+      if (foreign8) return { content: [{ type: "text", text: foreign8 }], details: {} };
+      const ctx = currentToolContext(execCtx);
+      if (!ctx) return staleToolResult();
+      const p = params as { id: string; status: "pending" | "in_progress" | "complete" };
+      if (!state.goal || !state.goal.taskList) {
+        return { content: [{ type: "text", text: "No task list in this goal." }], details: {} };
+      }
+      const tl = state.goal.taskList;
+      // v0.38.48: copy-swap (see complete_task). Message strings are pinned
+      // by tests/task-atomicity-gate.test.ts.
+      const t = findTask(tl, p.id);
+      if (!t) return { content: [{ type: "text", text: `Task ${p.id} not found.` }], details: {} };
+      // v0.38.49 audit: same-status moves are no-ops with a state-fact
+      // reply, not a persist round-trip reporting a change that happened.
+      if (t.status === p.status) return { content: [{ type: "text", text: `Task ${p.id} is already ${p.status}.` }], details: {} };
+      if (t) {
+        if (p.status === "complete") {
           const checkRes = await verifyTaskMilestone(ctx, t.verificationContract, signal);
           if (checkRes) {
             return {
               content: [{
                 type: "text",
-                text: `Task ${p.id} milestone verification FAILED for command \`${checkRes.failedCommand}\` (exit code ${checkRes.exitCode}):\n\n${checkRes.output}\n\nTask ${p.id} remains in_progress. Fix the failure before marking complete.`,
+                text: `Task ${p.id} milestone verification FAILED for command \`${checkRes.failedCommand}\` (exit code ${checkRes.exitCode}):\n\n${checkRes.output}\n\nTask ${p.id} remains ${t.status}. Fix the failure before marking complete.`,
               }],
               details: {},
             };
           }
-          t.status = "complete";
-          updateGoal({ taskList: tl }, ctx);
-          return { content: [{ type: "text", text: `Task ${p.id} marked complete.` }], details: {} };
         }
-        if (t.subtasks) queue.push(...t.subtasks);
+        if (!updateGoal({ taskList: withTaskStatus(tl, p.id, p.status) }, ctx)) {
+          return { content: [{ type: "text", text: `Task ${p.id} could not move to ${p.status} — the persist failed and no state changed. Retry.` }], details: {} };
+        }
+        return { content: [{ type: "text", text: `Task ${p.id} → ${p.status}` }], details: {} };
       }
-      return { content: [{ type: "text", text: `Task ${p.id} not found.` }], details: {} };
     },
   }));
 
   pi.registerTool(defineTool({
-    name: "update_task_status",
-    label: "Update task status",
-    description: "Update a task's status (pending/in_progress/complete).",
+    name: "update_task_batch",
+    label: "Update task batch",
+    description: "Atomically update several tasks at once: the whole batch is validated first, milestones are verified, then all statuses persist in one write. Any failure rejects the batch and leaves state untouched.",
     parameters: Type.Object({
-      id: Type.String(),
-      status: Type.Union([Type.Literal("pending"), Type.Literal("in_progress"), Type.Literal("complete")]),
+      updates: Type.Array(Type.Object({
+        id: Type.String({ description: "Task id to update" }),
+        status: Type.Union([Type.Literal("pending"), Type.Literal("in_progress"), Type.Literal("complete")]),
+      }), { description: "Status updates to apply atomically (each task id at most once)" }),
     }),
     async execute(_id, params, signal, _onUpdate, execCtx) {
-      const foreign8 = foreignToolGuard(execCtx);
-      if (foreign8) return { content: [{ type: "text", text: foreign8 }], details: {} };
+      const foreignBatch = foreignToolGuard(execCtx);
+      if (foreignBatch) return { content: [{ type: "text", text: foreignBatch }], details: {} };
       const ctx = currentToolContext(execCtx);
       if (!ctx) return staleToolResult();
-      const p = params as { id: string; status: "pending" | "in_progress" | "complete" };
+      const p = params as { updates: TaskStatusUpdate[] };
       if (!state.goal || !state.goal.taskList) {
         return { content: [{ type: "text", text: "No task list in this goal." }], details: {} };
       }
       const tl = state.goal.taskList;
-      const queue: any[] = [...tl.tasks];
-      while (queue.length > 0) {
-        const t = queue.shift();
-        if (t.id === p.id) {
-          if (p.status === "complete") {
-            const checkRes = await verifyTaskMilestone(ctx, t.verificationContract, signal);
-            if (checkRes) {
-              return {
-                content: [{
-                  type: "text",
-                  text: `Task ${p.id} milestone verification FAILED for command \`${checkRes.failedCommand}\` (exit code ${checkRes.exitCode}):\n\n${checkRes.output}\n\nTask ${p.id} remains ${t.status}. Fix the failure before marking complete.`,
-                }],
-                details: {},
-              };
-            }
+      // Phase 1 — validate the WHOLE batch before any verification runs.
+      const validation = validateTaskBatch(tl, p.updates);
+      if (!validation.ok) {
+        return { content: [{ type: "text", text: validation.error }], details: {} };
+      }
+      // Phase 2 — verify every milestone moving to complete. All failures
+      // are collected so one bad milestone does not hide another; NOTHING
+      // is applied until every verification passes (mid-batch kill here
+      // leaves state unchanged — the copy below does not exist yet).
+      const failures: string[] = [];
+      for (const e of validation.entries) {
+        if (e.status === "complete" && e.task.status !== "complete") {
+          const checkRes = await verifyTaskMilestone(ctx, e.task.verificationContract, signal);
+          if (checkRes) {
+            failures.push(`Task ${e.task.id} milestone verification FAILED for command \`${checkRes.failedCommand}\` (exit code ${checkRes.exitCode}):\n\n${checkRes.output}`);
           }
-          t.status = p.status;
-          updateGoal({ taskList: tl }, ctx);
-          return { content: [{ type: "text", text: `Task ${p.id} → ${p.status}` }], details: {} };
         }
-        if (t.subtasks) queue.push(...t.subtasks);
       }
-      return { content: [{ type: "text", text: `Task ${p.id} not found.` }], details: {} };
+      if (failures.length > 0) {
+        return {
+          content: [{
+            type: "text",
+            text: `Task batch rejected — ${failures.length} milestone verification${failures.length === 1 ? "" : "s"} failed. No task was changed:\n\n${failures.join("\n\n")}`,
+          }],
+          details: {},
+        };
+      }
+      // Phase 3 — copy, apply, persist ONCE.
+      if (!updateGoal({ taskList: applyValidatedBatch(tl, validation.entries) }, ctx)) {
+        return { content: [{ type: "text", text: "Task batch could not persist — the write failed and no state changed. Retry." }], details: {} };
+      }
+      const applied = validation.entries.map((e) => `${e.task.id} → ${e.status}`).join(", ");
+      return { content: [{ type: "text", text: `Task batch applied (${validation.entries.length}): ${applied}.` }], details: {} };
     },
   }));
 

package/extensions/task-batch.ts

@@ -0,0 +1,156 @@
+// Task-batch atomicity core (v0.38.48).
+//
+// The single-task tools used to mutate the live task list in place and then
+// persist — a mid-batch kill (or a late verification failure) left partial
+// state behind with no record of what was intended. This module is the whole
+// mutation discipline:
+//
+//   validate whole (ids resolve, no duplicates) → verify milestones →
+//   copy + apply → persist once.
+//
+// Everything here is pure except the injected verify/persist callbacks, so
+// the contract is pinnable without a harness: a rejected batch returns the
+// ORIGINAL list object untouched, and the tools persist exactly once.
+
+import type { Task, TaskList } from "./goal-loop-core.js";
+
+export type TaskStatus = "pending" | "in_progress" | "complete";
+
+export interface TaskStatusUpdate {
+  id: string;
+  status: TaskStatus;
+}
+
+export interface ValidatedTaskUpdate {
+  task: Task;
+  status: TaskStatus;
+}
+
+export type BatchValidation =
+  | { ok: true; entries: ValidatedTaskUpdate[] }
+  | { ok: false; error: string };
+
+/** Breadth-first search over top-level tasks and subtasks, in list order. */
+export function findTask(taskList: TaskList, id: string): Task | null {
+  const queue: Task[] = [...taskList.tasks];
+  while (queue.length > 0) {
+    const t = queue.shift()!;
+    if (t.id === id) return t;
+    if (t.subtasks) queue.push(...t.subtasks);
+  }
+  return null;
+}
+
+/**
+ * Validate the WHOLE batch before anything is verified, copied, or
+ * persisted. Every id must resolve and appear exactly once; statuses must
+ * be legal. Any failure names the offending entry and changes nothing.
+ */
+export function validateTaskBatch(
+  taskList: TaskList,
+  updates: TaskStatusUpdate[],
+): BatchValidation {
+  if (!Array.isArray(updates) || updates.length === 0) {
+    return { ok: false, error: "Task batch is empty — pass at least one {id, status} update." };
+  }
+  const seen = new Set<string>();
+  const entries: ValidatedTaskUpdate[] = [];
+  for (const u of updates) {
+    if (!u || typeof u.id !== "string" || !u.id) {
+      return { ok: false, error: "Task batch rejected — every update needs a non-empty string id. No task was changed." };
+    }
+    if (u.status !== "pending" && u.status !== "in_progress" && u.status !== "complete") {
+      return { ok: false, error: `Task batch rejected — update for \"${u.id}\" carries an illegal status ${JSON.stringify((u as { status: unknown }).status)}. No task was changed.` };
+    }
+    if (seen.has(u.id)) {
+      return { ok: false, error: `Task batch rejected — duplicate update for task \"${u.id}\" in one batch (each task may appear once). No task was changed.` };
+    }
+    seen.add(u.id);
+    const task = findTask(taskList, u.id);
+    if (!task) {
+      return { ok: false, error: `Task batch rejected — task \"${u.id}\" not found. No task was changed.` };
+    }
+    entries.push({ task, status: u.status });
+  }
+  return { ok: true, entries };
+}
+
+/**
+ * Apply validated entries to a DEEP COPY. The input list is never mutated,
+ * so a kill between copy and persist (or a persist failure) leaves the
+ * caller's state object exactly as it was.
+ */
+export function applyValidatedBatch(
+  taskList: TaskList,
+  entries: ValidatedTaskUpdate[],
+): TaskList {
+  const next: TaskList = JSON.parse(JSON.stringify(taskList)) as TaskList;
+  for (const e of entries) {
+    const target = findTask(next, e.task.id);
+    // Proven by validateTaskBatch against the same shape — a missing target
+    // here would mean the list changed under us; fail loudly, never partial.
+    if (!target) throw new Error(`Task batch apply failed — task \"${e.task.id}\" vanished mid-batch. No persist was attempted.`);
+    target.status = e.status;
+  }
+  return next;
+}
+
+/** Copy with an arbitrary patch merged into one task; the input list is untouched. */
+export function patchTaskCopy(
+  taskList: TaskList,
+  id: string,
+  patch: Partial<Task>,
+): TaskList {
+  const next: TaskList = JSON.parse(JSON.stringify(taskList)) as TaskList;
+  const target = findTask(next, id);
+  if (!target) throw new Error(`patchTaskCopy: task "${id}" not found.`);
+  Object.assign(target, patch);
+  return next;
+}
+
+/** Copy with a single task's status replaced; the input list is untouched. */
+export function withTaskStatus(
+  taskList: TaskList,
+  id: string,
+  status: TaskStatus,
+): TaskList {
+  const task = findTask(taskList, id);
+  if (!task) throw new Error(`withTaskStatus: task \"${id}\" not found.`);
+  return applyValidatedBatch(taskList, [{ task, status }]);
+}
+
+export interface OpenTaskInfo {
+  id: string;
+  title: string;
+  status: TaskStatus;
+}
+
+/**
+ * Every committed task (top-level and subtask) still open, in list order.
+ * Complete tasks and tasks carrying a recorded deferral are not open — a
+ * deferral is an explicit durable-vs-defer judgment, not abandonment.
+ */
+export function collectOpenTasks(taskList: TaskList): OpenTaskInfo[] {
+  const open: OpenTaskInfo[] = [];
+  const queue: Task[] = [...taskList.tasks];
+  while (queue.length > 0) {
+    const t = queue.shift()!;
+    if (t.status !== "complete" && !t.deferred) {
+      open.push({ id: t.id, title: t.title, status: t.status });
+    }
+    if (t.subtasks) queue.push(...t.subtasks);
+  }
+  return open;
+}
+
+/** The refusal text for the complete_goal pending-task gate. Names every open task. */
+export function formatOpenTaskRefusal(open: OpenTaskInfo[]): string {
+  const lines = open.map((t) => `- ${t.id}: \"${t.title}\" (${t.status})`);
+  return (
+    `complete_goal REFUSED — ${open.length} open committed task${open.length === 1 ? " is" : "s are"} still unfinished:\n` +
+    lines.join("\n") +
+    `\n\nFinish them with complete_task or update_task_batch, or record an explicit ` +
+    `deferral for a genuinely blocked item with record_goal_judgment ` +
+    `(choice=\"deferred\", taskId=\"<id>\"). The claim was NOT sent to the auditor and no state changed.`
+  );
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-goal-list-loop-audit",
-  "version": "0.38.47",
+  "version": "0.38.49",
   "description": "Mission control for autonomous pi: interview-drafted goals, an audited task queue, and forever-loops (metric, spec, project-audit) that run for hours. A detached extension-less auditor process re-verifies every completion with raw evidence without holding the main pi turn; confirmed drafts, decision pauses and consent gates keep you in charge.",
   "license": "AGPL-3.0-only",
   "author": "dracon",

package/prompts/goal-loop-continuation.md

@@ -55,9 +55,9 @@ When a goal, list item, or pending task explicitly says `Agent: Designer`, `Role
 
 ## Available tools
 
-You have `read`, `write`, `edit`, `bash`, `grep`, `find`, `ls`, the `subagent` tool, and the goal toolkit (`propose_task_list`, `complete_task`, `update_task_status`, `record_goal_judgment`, `pause_goal`, `complete_goal`), plus the list tools (`list_add`, `list_status`, `list_activate`) — when the user asks to queue more work ("add these to my list", "queue these 10 things"), call `list_add` with the items; when unsure what is running or waiting, call `list_status`.
+You have `read`, `write`, `edit`, `bash`, `grep`, `find`, `ls`, the `subagent` tool, and the goal toolkit (`propose_task_list`, `complete_task`, `update_task_status`, `update_task_batch`, `record_goal_judgment`, `pause_goal`, `complete_goal`), plus the list tools (`list_add`, `list_status`, `list_activate`) — when the user asks to queue more work ("add these to my list", "queue these 10 things"), call `list_add` with the items; when unsure what is running or waiting, call `list_status`.
 
-If the objective decomposes into milestones and no task list exists yet, call `propose_task_list` early — the user confirms it, then you track progress with `complete_task` / `update_task_status` as you go (not in a batch at the end). Limits: 20 tasks, 5 subtasks per task.
+If the objective decomposes into milestones and no task list exists yet, call `propose_task_list` early — the user confirms it, then you track progress with `complete_task` / `update_task_status` / `update_task_batch` as you go (not as a post-hoc checklist at the end). For several status changes at once, prefer one `update_task_batch` call: the whole batch validates first, milestones verify, then all statuses persist in one write. Limits: 20 tasks, 5 subtasks per task.
 
 When the agent calls any of these, the orchestrator tracks the call and persists state to `.pi-glla/active.jsonl`.
 
@@ -156,6 +156,8 @@ Do NOT conclude "the loop is too eager" or "I am broken" before checking what a
 
 Use tasks as PROGRESS TRACKERS during your work — not as a post-hoc checklist to batch-mark at the end.
 
+Pending-task gate: `complete_goal` is refused BEFORE the auditor when committed tasks are still open — the refusal names each open task and sends nothing to the auditor. Finish them with `complete_task` / `update_task_batch`, or record an explicit deferral with `record_goal_judgment` (`choice="deferred"` + `taskId`) for a genuinely blocked item.
+
 Before deciding that the goal is achieved, perform a completion audit against the actual current state:
 
 - Restate the objective as concrete deliverables or success criteria.
@@ -174,7 +176,7 @@ recap and synthesizes a recorded-facts-only fallback at terminalization when a
 legacy or incomplete caller omits it; never invent a commit, changed file, or
 passing test to make the recap sound complete.
 
-Then call `complete_goal`. The orchestrator will spawn an **isolated auditor** in a fresh session to verify, and either accept (mark goal complete) or reject (continue work).
+Then call `complete_goal` — only with every committed task finished or explicitly deferred, otherwise the claim is refused before audit (see the pending-task gate above). The orchestrator will spawn an **isolated auditor** in a fresh session to verify, and either accept (mark goal complete) or reject (continue work).
 
 If your work has shifted to items different from the original objective (the original was blocked, higher-ROI items emerged): pass `newObjective` to `complete_goal` to atomically update the objective and audit against the NEW one — do NOT call `complete_goal` on the original objective after shipping different work, the auditor will disapprove because the original isn't shipped. Alternatively `pause_goal` proposing a `/goal tweak` if the shift needs the user's call.
 
@@ -203,4 +205,4 @@ The orchestrator's backstop is the stall watchdog: three consecutive turns with
 
 `complete_goal` submits a nonterminal claim, not a completion verdict. While the detached audit is pending, do not say the goal is done/complete/approved or present a final success summary. Do not wait or poll. If a response is needed, give one brief pending-status sentence. GLLA posts the concrete outcome-first summary into chat after verified approval and durable archive, without needing another user prompt. Do not duplicate that summary. A rejected claim remains unfinished and repair work continues.
 
-The agent-written completionSummary is user-facing evidence, not a step log: open with the outcome in plain words, then one verifiable result per label with its proof inline (test counts, file paths, commit refs) — never raw run stats. Keep each label value to one line of ~90 chars so every chat bullet fits without a trailing …; cite human-readable proof (counts, versions, repo-relative paths, PR numbers) and never machine paths (/var/tmp logs, tarballs — those live in the archive only). Cut values at clause boundaries, never mid-word; write Next: as one concrete follow-up action or none (audit-self-referential lines like "verdict decides" are stripped at render); pass what was deliberately left out as the complete_goal leftOut parameter — it renders as the closing bullet, and is omitted when absent.
+The agent-written completionSummary is user-facing evidence, not a step log: open with the outcome in plain words, then one verifiable result per label with its proof inline (test counts, file paths, commit refs) — never raw run stats. Keep each label value to one or two short clauses so it survives the renderer's clause-boundary clipping (rich sections budget ~200 chars per value); cite human-readable proof (counts, versions, repo-relative paths, PR numbers) and never machine paths (/var/tmp logs, tarballs — those live in the archive only). Cut values at clause boundaries, never mid-word; write Next: as one concrete follow-up action or none (audit-self-referential lines like "verdict decides" are stripped at render); pass what was deliberately left out as the complete_goal leftOut parameter — it renders as the closing bullet, and is omitted when absent.