pi-goal-list-loop-audit 0.38.48 → 0.38.50

package/CHANGELOG.md

@@ -1,5 +1,73 @@
 # Changelog
 
+## 0.38.50 — Gemini-gap terminal upgrade: grouped findings, request-echo headline, duration line (2026-09-12)
+
+Surveyed four Gemini report screenshots (audit/GEMINI-SUMMARY-GAP-2026-09-11.md)
+and closed the gap in the terminal render only (chat + transcript + archive
+ human layer; progress cards, status, widget, external notifies unchanged).
+
+### Added
+
+- **Agent-structured finding groups:** optional `complete_goal findingGroups`
+  (one group per work area, findings as `Lead: body` with repo-relative
+  `path:line` evidence tokens, sanitized at the claim boundary). Fewer than
+  four groups render as nested `#### n. Area` subsections; four or more
+  render as an Area | Finding | Evidence table. Evidence extraction is
+  mechanical — absolute/home-dir/machine paths never become evidence.
+  Single-area work omits the parameter; the flat six-label render stays
+  the fallback.
+- **Request-echo headline:** `## Done: <objective> — <outcome>` (and
+  `## Aborted: …` for aborted records) so the title mirrors the ask.
+- **Duration line:** `— N turns · … elapsed · M audits` from durable state
+  directly under the headline; unknown facts stay absent.
+- **Raised budgets:** findings 8 → 12, values 200 → 400 chars, Next 4 → 6.
+
+### Preserved
+
+- Auditor-verified-before-posting, the verbatim six-label machine record,
+  and the honesty rules (PASS only on `pass`, `NO VERDICT` never renders,
+  pipe escaping) are unchanged.
+
+## 0.38.49 — audit-pass drift fixes: prompt gate, summary segmentation, task honesty (2026-09-11)
+
+Full-project audit pass on v0.38.48 (three parallel scout surveys). Six new
+findings, all fixed on main; scout claims that were unproven, stale, or
+by-design are disposed with rationale in the pass note, not as findings.
+
+### Fixed
+
+- **Continuation prompt drift:** the Available-tools list and task workflow
+  now name `update_task_batch` (validate whole, verify milestones, persist
+  once) and the pending-task completion gate (`complete_goal` refused
+  before audit while committed tasks are open; `record_goal_judgment`
+  `choice=deferred` + `taskId` exempts a blocked item). Completion-voice
+guidance matches the rich-section renderer budgets.
+- **README verify path:** the `complete_goal` steps now include the
+  pending-task refusal before audit.
+- **Docs versions/voice:** INSTALL updating examples show the current
+  versions; the supervision design doc distinguishes the verbatim six-label
+  archive record from the rich chat/transcript sections and the compact
+  width-bound projection.
+- **Summary gate segmentation:** `missingCompletionSummaryLabels` segments
+  on the same last-occurrence positions as every projector, so a label
+  named inside an earlier value can no longer pass the gate while rendering
+  shifted (removed the now-dead `labelIndex`).
+- **Task-tool honesty:** completing an already-complete task reports
+  `Task <id> is already complete.` and same-status `update_task_status`
+  moves report `already <status>` instead of the not-found fallthrough or
+a no-op persist.
+- **Sidecar pending boundary:** the approval-render outbox and the
+  update-check refresh defer while sessionDir resolution is pending instead
+  of creating (or latching degraded on) a `<cwd>/.pi-glla` fallback tree.
+
+### Tests
+
+- Re-baselined `tests/context-growth-measurement.test.ts` to 22_570 chars
+  / 22_670 bytes per payload (+769 chars incl. one em dash) with exact
+  multiples preserved across probe sizes. New pins: stolen-label gate
+  agreement, already-complete/no-op task messages, sidecar pending deferral.
+  `tsc` clean.
+
 ## 0.38.48 — atomic task batches + pending-task completion gate (2026-09-11)
 
 ### Added

package/INSTALL.md

@@ -31,11 +31,11 @@ GLLA loads into new pi sessions. If pi is already open, reload that session:
 
 ## Updating
 
-The status line always shows the running version (`glla: … · v0.38.46`).
+The status line always shows the running version (`glla: … · v0.38.48`).
 When the npm registry is ahead, it also nudges:
 
 ```text
-glla: … · v0.38.45 · update v0.38.46 available
+glla: … · v0.38.47 · update v0.38.48 available
 ```
 
 The nudge comes from a daily sidecar check (`.pi-glla/update-check.json`),

package/README.md

@@ -250,12 +250,14 @@ When the agent calls `complete_goal`, GLLA:
 
 1. runs the contract's mechanical checks when a release or command check is
    specified;
-2. writes an identity-bound completion claim;
-3. starts a detached, fresh pi RPC worker for the audit;
-4. asks the worker to inspect the repository and run bounded checks;
-5. requires raw evidence for each verification-contract item through the
+2. refuses the claim before audit when committed tasks are still open
+   (tasks with a recorded deferral are exempt), naming each open task;
+3. writes an identity-bound completion claim;
+4. starts a detached, fresh pi RPC worker for the audit;
+5. asks the worker to inspect the repository and run bounded checks;
+6. requires raw evidence for each verification-contract item through the
    orchestrator-side regression shield;
-6. keeps the goal open on infrastructure failure, missing evidence, or
+7. keeps the goal open on infrastructure failure, missing evidence, or
    disapproval instead of silently archiving it.
 
 The auditor is intentionally isolated from the implementing conversation and

package/docs/DESIGN-long-running-supervision.md

@@ -110,10 +110,16 @@ status/reason, durable telemetry, captured audit verdicts, and known archive
 path. It says `not recorded` when a changed-file manifest or test result is not
 available. It never infers a passing test or invents a commit.
 
-The full recap lives in the archive and status/history surfaces. Every
-terminal goal notification—including version-bearing already-shipped claims,
-explicit goal/list cancellation, and `/glla wipe`—includes a compact
-projection of all six labels; loop notifications do the same. The terminal
+The full six-label recap lives verbatim in the archive (`## Completion summary`)
+and the status/history surfaces. The human layer in chat, transcript, and the
+archive's `## Terminal summary` renders the same facts as rich sections
+(`## Done: <objective> — <outcome>`, duration line, Key Findings grouped by area
+or tabulated at 4+ groups, Verification Summary table, Next, capped and clipped
+to fixed budgets). Width-bound and external surfaces (status line, widget card,
+external notifies) use the compact single-line projection of all six labels.
+Every terminal goal notification, including version-bearing already-shipped claims,
+explicit goal/list cancellation, and `/glla wipe`, carries either the rich sections
+or the compact projection; loop notifications do the same. The terminal
 notification may use a compact excerpt. The executor recap and independent
 auditor verdict stay separate: an approval is not manufactured from the
 presence of a summary.

package/docs/INDEX.md

@@ -16,7 +16,7 @@ Policy contracts and recent changes live in the `audit/` directory of the
   failback; v0.35.9 hardened cross-version npm tarball checks; v0.35.10
   handles multi-entry npm dry-run reports; v0.35.11 accepts both npm report
   shapes; v0.35.12 supports npm 12's keyed pack reports; v0.35.13 fixes stale-API recovery loops.
-  v0.35.14–v0.38.48 continue through the supervisor freeze (`/glla pause`),
+  v0.35.14–v0.38.50 continue through the supervisor freeze (`/glla pause`),
   load hold, auditor picker parity, Windows launch fix, zombie-watchdog
   subagent carve-out, due-wait backstop, the `/glla agents` visibility panel,
   durable state-root selection, blank-until-resume auditor context, frozen

package/extensions/approval-render-store.ts

@@ -1,6 +1,7 @@
 import * as fs from "node:fs";
 import * as path from "node:path";
 import { appendLedger, ensureDirs, nowIso, piGlaDir, runPersistStep } from "./goal-loop-core.js";
+import { stateRootPending } from "./glla-state-root.js";
 
 /** Durable terminal-summary outbox. A toast or a live host is not delivery:
  * only a confirmed visible session message acknowledges a render. */
@@ -67,6 +68,9 @@ function readRenders(cwd: string): PendingApprovalRender[] {
 }
 
 function writeRenders(cwd: string, renders: PendingApprovalRender[]): boolean {
+  // v0.38.49 audit: pending sessionDir resolution defers every write that
+  // would otherwise recreate <cwd>/.pi-glla — the sidecar is no exception.
+  if (stateRootPending()) return false;
   const landed = runPersistStep("persistApprovalRender", () => {
     ensureDirs(cwd);
     const file = approvalRenderStorePath(cwd);

package/extensions/completion-summary.ts

@@ -1,5 +1,5 @@
-import type { Goal, Status } from "./goal-loop-core.js";
-import { truncateCells } from "./goal-loop-display.js";
+import type { FindingGroup, Goal, Status } from "./goal-loop-core.js";
+import { fmtElapsed, truncateCells } from "./goal-loop-display.js";
 
 /**
  * The durable, user-facing terminal recap contract. Keep this as a small
@@ -31,10 +31,6 @@ export interface CompletionSummaryFacts {
   archivePath?: string;
 }
 
-function labelIndex(text: string, label: CompletionSummaryLabel): number {
-  return text.toLowerCase().indexOf(label.toLowerCase());
-}
-
 /**
  * Validation/version annotations are metadata, not recap fields. Keep them
  * out of the parser so a generated NOTE containing examples such as
@@ -45,17 +41,20 @@ function completionSummaryBody(text: string): string {
   return annotation?.index === undefined ? text : text.slice(0, annotation.index);
 }
 
-/** Return labels that are absent or have no value after the label. */
+/** Return labels that are absent or have no value after the label. Segments on
+ * the same last-occurrence positions as every projector (compact, multi-line,
+ * rich): a label named inside an earlier value must not shift the gate away
+ * from what the user will actually read. */
 export function missingCompletionSummaryLabels(text: string): CompletionSummaryLabel[] {
   const normalized = completionSummaryBody(text).trim();
+  const positions = labelPositions(normalized.toLowerCase());
   return COMPLETION_SUMMARY_LABELS.filter((label) => {
-    const start = labelIndex(normalized, label);
-    if (start < 0) return true;
-    const valueStart = start + label.length;
-    const next = COMPLETION_SUMMARY_LABELS
-      .map((candidate) => labelIndex(normalized.slice(valueStart), candidate))
-      .filter((index) => index >= 0)
-      .map((index) => valueStart + index)
+    const current = positions.find((entry) => entry.label === label);
+    if (!current) return true;
+    const valueStart = current.start + label.length;
+    const next = positions
+      .filter((entry) => entry.start > current.start)
+      .map((entry) => entry.start)
       .sort((a, b) => a - b)[0];
     return normalized.slice(valueStart, next ?? normalized.length).trim().length === 0;
   });
@@ -270,18 +269,27 @@ export function withoutStaleNext(details: string[] | undefined): string[] {
 }
 
 /** Rich terminal voice (field 20260911_003839/003903/003907 — the
- * Antigravity close): section headers, numbered findings with bold
- * leads + code refs, and a verification table, instead of the flat
- * six-bullet card. Scope is the terminal render only (chat +
+ * Antigravity close; v0.38.50 Gemini-gap survey audit/GEMINI-SUMMARY-GAP-2026-09-11.md:
+ * grouped area sections with nested findings + file:line evidence, a
+ * request-echo headline, a duration line, and an automatic table once
+ * findings span 4+ groups). Scope is the terminal render only (chat +
  * transcript + archive human layer); progress cards, status line, and
  * external notifies keep their compact projections. Verbose by owner
- * choice: findings cap 8, values 200, table cells 200. */
-export const RICH_FINDINGS_CAP = 8;
-export const RICH_VALUE_BUDGET = 200;
-export const RICH_NEXT_CAP = 4;
+ * choice: findings cap 12, values 400, table cells 400, Next 6. */
+export const RICH_FINDINGS_CAP = 12;
+export const RICH_VALUE_BUDGET = 400;
+export const RICH_NEXT_CAP = 6;
+/** v0.38.50: objective echo clipped to a headline-safe width. */
+export const RICH_OBJECTIVE_ECHO_CHARS = 80;
+/** v0.38.50: findings spanning this many groups render as a table
+ * (the 12-row screen-by-screen example); fewer stay nested. */
+export const RICH_TABLE_GROUP_THRESHOLD = 4;
+/** v0.38.50: evidence tokens per finding cell — density, not a dump. */
+export const RICH_EVIDENCE_TOKENS_PER_FINDING = 4;
 
 export interface RichTerminalParts {
   headline: string;
+  durationLine: string | null;
   findingLines: string[];
   tableLines: string[];
   nextLines: string[];
@@ -315,6 +323,63 @@ function leadBody(detail: string): { lead: string; body: string } {
   return { lead: detail.slice(0, separator).trim() || "Note", body: detail.slice(separator + 1).trim() };
 }
 
+/**
+ * v0.38.50: repo-relative `path:line` evidence tokens (soundManager.ts:333,
+ * sim.ts:4505-4530). Absolute paths, home-dir paths, and machine temp
+ * paths are NOT evidence — those stay in the archive only. Extraction is
+ * mechanical substring movement, never inference.
+ */
+const EVIDENCE_TOKEN_PATTERN = /(?<![/~+\w])[\w.+][\w./-]*\.[A-Za-z0-9]{1,8}:\d+(?:-\d+)?/g;
+
+export function extractEvidenceTokens(text: string): { text: string; evidence: string[] } {
+  const evidence: string[] = [];
+  const stripped = text
+    .replace(EVIDENCE_TOKEN_PATTERN, (match) => {
+      if (evidence.length < RICH_EVIDENCE_TOKENS_PER_FINDING && !evidence.includes(match)) evidence.push(match);
+      return "";
+    })
+    .replace(/\s+/g, " ")
+    .replace(/\s+([,.;:])/g, "$1")
+    .trim();
+  return { text: stripped, evidence };
+}
+
+/**
+ * v0.38.50: enforce the total-findings budget across groups in order —
+ * groups that go empty are dropped so the table/nesting never shows a
+ * bare area header.
+ */
+export function takeBudgetedGroups(groups: FindingGroup[]): FindingGroup[] {
+  const out: FindingGroup[] = [];
+  let remaining = RICH_FINDINGS_CAP;
+  for (const group of groups) {
+    if (remaining <= 0) break;
+    const findings = group.findings.slice(0, remaining);
+    if (findings.length === 0) continue;
+    out.push({ title: group.title, findings });
+    remaining -= findings.length;
+  }
+  return out;
+}
+
+/**
+ * v0.38.50: one compact duration line from durable goal state — turns,
+ * wall-clock elapsed since creation, and audit count. Only known facts
+ * render (absent stays absent); null when nothing is known.
+ */
+export function buildDurationLine(goal: Goal, now = Date.now()): string | null {
+  const segs: string[] = [];
+  const turns = goal.telemetry?.turns;
+  if (typeof turns === "number" && Number.isFinite(turns) && turns >= 0) {
+    segs.push(`${turns} turn${turns === 1 ? "" : "s"}`);
+  }
+  const started = Date.parse(goal.createdAt ?? "");
+  if (Number.isFinite(started)) segs.push(`${fmtElapsed(now - started)} elapsed`);
+  const audits = Array.isArray(goal.auditHistory) ? goal.auditHistory.length : 0;
+  if (audits > 0) segs.push(`${audits} audit${audits === 1 ? "" : "s"}`);
+  return segs.length > 0 ? `\u2014 ${segs.join(" \u00b7 ")}` : null;
+}
+
 /** Partition informing details into findings / Tests / next buckets. */
 export function partitionRichDetails(details: string[]): { findings: string[]; tests: string[]; next: string[] } {
   const findings: string[] = [];
@@ -328,18 +393,60 @@ export function partitionRichDetails(details: string[]): { findings: string[]; t
   return { findings, tests, next };
 }
 
-/** Build the section parts shared by chat, transcript, and archive. */
+/**
+ * v0.38.50: request-echo headline — the title mirrors the ask (the
+ * Gemini shape) with the outcome second. Without an objective the legacy
+ * `## Done — outcome` shape stays, so direct unit callers are unaffected.
+ */
+export function requestEchoHeadline(kind: "Done" | "Aborted", objective: string | undefined, outcome: string): string {
+  const echo = objective?.trim() ? clipSummaryValue(objective.trim(), RICH_OBJECTIVE_ECHO_CHARS) : null;
+  return echo ? `## ${kind}: ${echo} \u2014 ${outcome}` : `## ${kind} \u2014 ${outcome}`;
+}
+
+/** Build the section parts shared by chat, transcript, and archive.
+ * v0.38.50: agent-structured groups render as `#### n. Area` subsections
+ * with nested evidence bullets; at RICH_TABLE_GROUP_THRESHOLD groups the
+ * same facts render as an Area | Finding | Evidence table instead.
+ * Without groups the flat six-label projection stays the fallback. */
 export function buildRichTerminalParts(args: {
   outcome: string;
   details: string[];
   countsLine: string;
   auditHistory?: Goal["auditHistory"];
+  objective?: string;
+  durationLine?: string | null;
+  groups?: FindingGroup[];
 }): RichTerminalParts {
   const { findings, tests, next } = partitionRichDetails(args.details);
-  const findingLines = findings.slice(0, RICH_FINDINGS_CAP).map((detail, i) => {
-    const { lead, body } = leadBody(detail);
-    return `${i + 1}. **${lead}** \u2014 ${clipSummaryValue(body, RICH_VALUE_BUDGET)}`;
-  });
+  const headline = requestEchoHeadline("Done", args.objective, args.outcome);
+  const budgeted = takeBudgetedGroups(args.groups ?? []);
+  const useTable = budgeted.length >= RICH_TABLE_GROUP_THRESHOLD;
+  const findingLines: string[] = [];
+  if (useTable) {
+    findingLines.push("| Area | Finding | Evidence |", "| --- | --- | --- |");
+    for (const group of budgeted) {
+      for (const finding of group.findings) {
+        const { text, evidence } = extractEvidenceTokens(finding);
+        const { lead, body } = leadBody(text);
+        findingLines.push(
+          `| ${escapeTableCell(clipSummaryValue(group.title, RICH_OBJECTIVE_ECHO_CHARS))} | ${escapeTableCell(`**${lead}** \u2014 ${clipSummaryValue(body, RICH_VALUE_BUDGET)}`)} | ${escapeTableCell(evidence.join(", ") || "\u2014")} |`,
+        );
+      }
+    }
+  } else if (budgeted.length > 0) {
+    budgeted.forEach((group, i) => {
+      findingLines.push(`#### ${i + 1}. ${clipSummaryValue(group.title, RICH_OBJECTIVE_ECHO_CHARS)}`);
+      for (const finding of group.findings) {
+        const { lead, body } = leadBody(finding);
+        findingLines.push(`- **${lead}** \u2014 ${clipSummaryValue(body, RICH_VALUE_BUDGET)}`);
+      }
+    });
+  } else {
+    findings.slice(0, RICH_FINDINGS_CAP).forEach((detail, i) => {
+      const { lead, body } = leadBody(detail);
+      findingLines.push(`${i + 1}. **${lead}** \u2014 ${clipSummaryValue(body, RICH_VALUE_BUDGET)}`);
+    });
+  }
   const tableRows: string[] = [];
   for (const detail of tests.slice(0, 2)) {
     const { body } = leadBody(detail);
@@ -358,16 +465,19 @@ export function buildRichTerminalParts(args: {
     return `- **${lead}** \u2014 ${clipSummaryValue(body, RICH_VALUE_BUDGET)}`;
   });
   return {
-    headline: `## Done \u2014 ${args.outcome}`,
+    headline,
+    durationLine: args.durationLine ?? null,
     findingLines,
     tableLines,
     nextLines,
   };
 }
 
-/** Compose parts + headline + section headers into markdown lines. */
+/** Compose parts + headline + section headers into markdown lines.
+ * v0.38.50: the duration line rides directly under the headline. */
 export function composeRichTerminalLines(parts: RichTerminalParts, opts?: { headline?: string }): string[] {
   const lines = [opts?.headline ?? parts.headline, ""];
+  if (parts.durationLine) lines.push(parts.durationLine, "");
   if (parts.findingLines.length > 0) {
     lines.push("### Key Findings & Remediation", ...parts.findingLines, "");
   }
@@ -385,7 +495,7 @@ export function composeRichTerminalLines(parts: RichTerminalParts, opts?: { head
  * raw six-label recap stays verbatim in `## Completion summary` as the
  * machine layer. Headline follows terminal status; aborted records never
  * wear a `Done` headline. */
-export function buildRichArchiveSection(goal: Goal, status: Status, archivePath: string): string[] {
+export function buildRichArchiveSection(goal: Goal, status: Status, archivePath: string, findingGroups?: FindingGroup[]): string[] {
   const facts: CompletionSummaryFacts = { goal, status, archivePath };
   const summary = resolveCompletionSummary(facts, goal.completionSummary).summary;
   const brief = humanCompletionBrief(summary, 140, RICH_VALUE_BUDGET);
@@ -400,10 +510,13 @@ export function buildRichArchiveSection(goal: Goal, status: Status, archivePath:
     details: withoutStaleNext(brief.details),
     countsLine,
     auditHistory: history,
+    objective: goal.objective,
+    durationLine: buildDurationLine(goal),
+    groups: findingGroups,
   });
   return [
     ...composeRichTerminalLines(parts, {
-      headline: status === "complete" ? parts.headline : `## Aborted \u2014 ${brief.outcome}`,
+      headline: status === "complete" ? parts.headline : requestEchoHeadline("Aborted", goal.objective, brief.outcome),
     }),
     trailerBullet(stripApprovalModel(approval)),
     trailerBullet(countsLine),
@@ -493,6 +606,11 @@ export interface TerminalApprovalRenderInput {
   auditNote?: string;
   /** v0.38.37: what the agent deliberately left out (complete_goal leftOut). */
   leftOut?: string;
+  /**
+   * v0.38.50: agent-structured finding groups (complete_goal findingGroups,
+   * sanitized at claim time). Absent keeps the flat six-label fallback.
+   */
+  findingGroups?: FindingGroup[];
 }
 
 export interface TerminalApprovalRender {
@@ -568,6 +686,9 @@ export function buildTerminalApprovalRender(input: TerminalApprovalRenderInput):
     details: withoutStaleNext(richDetails),
     countsLine,
     auditHistory: input.goal.auditHistory,
+    objective: input.goal.objective,
+    durationLine: buildDurationLine(input.goal),
+    groups: input.findingGroups,
   });
   const chatBody = composeRichTerminalLines(richParts);
   const transcriptBody = composeRichTerminalLines(richParts);

package/extensions/glla-update-check.ts

@@ -1,6 +1,7 @@
 import { spawn } from "node:child_process";
 import * as fs from "node:fs";
 import * as path from "node:path";
+import { stateRootPending } from "./glla-state-root.js";
 import {
   compareVersions,
   GLLA_PACKAGE_NAME,
@@ -60,6 +61,10 @@ export function refreshUpdateCheck(
   now = Date.now(),
   spawnFn: SpawnFn = spawn as unknown as SpawnFn,
 ): void {
+  // v0.38.49 audit: while sessionDir resolution is pending there is no
+  // session root yet — skip the refresh (and its cache write) instead of
+  // creating a <cwd>/.pi-glla fallback tree.
+  if (stateRootPending()) return;
   try {
     const cached = readUpdateCheckRaw(cwd);
     if (cached && now - cached.checkedAt < UPDATE_CHECK_TTL_MS) return;

package/extensions/goal-loop-core.ts

@@ -272,6 +272,52 @@ export type AuditorRecoveryFailureClass = "transport" | "timeout" | "no-verdict"
  * completion assertion; the lifecycle fields make an interrupted isolated
  * audit distinguishable from one that is actively running. Fields beyond
  * `at` are optional so v0.34.20 and older claims remain recoverable. */
+/**
+ * v0.38.50 (Gemini-gap survey): one agent-structured work area for the
+ * grouped terminal render. Presentation only — the six-label
+ * completionSummary stays the audited substance. Titles and findings are
+ * agent-authored and clipped at render; evidence tokens (`path:line`)
+ * are extracted mechanically, never inferred.
+ */
+export interface FindingGroup {
+  title: string;
+  findings: string[];
+}
+
+export const MAX_FINDING_GROUPS = 6;
+export const MAX_GROUP_FINDINGS = 6;
+export const MAX_GROUP_TITLE_CHARS = 120;
+export const MAX_GROUP_FINDING_CHARS = 500;
+
+/**
+ * Bound agent-supplied finding groups at the trust boundary. Drops
+ * non-object groups, blank titles, and empty findings; clips the rest.
+ * Returns undefined when nothing valid survives — the flat six-label
+ * render stays the fallback, never a half-structured projection.
+ */
+export function sanitizeFindingGroups(value: unknown): FindingGroup[] | undefined {
+  if (!Array.isArray(value)) return undefined;
+  const groups: FindingGroup[] = [];
+  for (const entry of value) {
+    if (groups.length >= MAX_FINDING_GROUPS) break;
+    if (!entry || typeof entry !== "object" || Array.isArray(entry)) continue;
+    const raw = entry as Record<string, unknown>;
+    const title = typeof raw.title === "string" ? raw.title.trim().slice(0, MAX_GROUP_TITLE_CHARS) : "";
+    if (!title) continue;
+    if (!Array.isArray(raw.findings)) continue;
+    const findings: string[] = [];
+    for (const finding of raw.findings) {
+      if (findings.length >= MAX_GROUP_FINDINGS) break;
+      if (typeof finding !== "string") continue;
+      const text = finding.trim().slice(0, MAX_GROUP_FINDING_CHARS);
+      if (text) findings.push(text);
+    }
+    if (findings.length === 0) continue;
+    groups.push({ title, findings });
+  }
+  return groups.length > 0 ? groups : undefined;
+}
+
 export interface PendingCompletion {
   completionSummary?: string;
   verificationSummary?: string;
@@ -300,6 +346,12 @@ export interface PendingCompletion {
    * terminal user summary; absent means nothing was deliberately left out.
    */
   leftOut?: string;
+  /**
+   * v0.38.50: agent-structured finding groups for the grouped terminal
+   * render (complete_goal findingGroups, sanitized at claim time).
+   * Absent means the flat six-label render stays the fallback.
+   */
+  findingGroups?: FindingGroup[];
   /**
    * Durable one-shot recovery fence. A parked claim may receive one
    * automatic retry after a validated healthy lifecycle/recovery event;
@@ -2157,6 +2209,10 @@ function normalizePendingCompletion(value: unknown): PendingCompletion {
     _timeoutEscalation <= 100
       ? _timeoutEscalation
       : undefined;
+  // v0.38.50: agent-structured finding groups survive reloads sanitized;
+  // garbage at the boundary degrades to absent (flat fallback), never
+  // to a half-structured projection.
+  const sanitizedGroups = sanitizeFindingGroups(raw.findingGroups);
   return {
     ...canonicalOrUnknown,
     ...(auditorCandidateRefs !== undefined ? { auditorCandidateRefs } : {}),
@@ -2169,6 +2225,7 @@ function normalizePendingCompletion(value: unknown): PendingCompletion {
     ...(auditorFallbackExhausted ? { auditorFallbackExhausted: true } : {}),
     ...(auditorFailureAt ? { auditorFailureAt } : {}),
     ...(timeoutEscalation !== undefined ? { timeoutEscalation } : {}),
+    ...(sanitizedGroups ? { findingGroups: sanitizedGroups } : {}),
     ...(phase === "running" || phase === "recovery-pending" || phase === "retry-waiting" ? { phase } : {}),
     ...(typeof raw.retryAttempts === "number"
       ? { retryAttempts: raw.retryAttempts }

package/extensions/loops/goal-auditor-hooks.ts

@@ -1441,12 +1441,14 @@ async function retryStoredCompletionAudit(origin: CompletionAuditOrigin = "provi
       record: approvalRecord,
       // v0.38.37: the deliberate non-do the agent claimed, if any.
       ...(claim.leftOut ? { leftOut: claim.leftOut } : {}),
+      // v0.38.50: agent-structured finding groups ride the audited claim.
+      ...(claim.findingGroups ? { findingGroups: claim.findingGroups } : {}),
       extras: inspectionSessionPath
         ? [`Auditor session kept for review: pi --session ${inspectionSessionPath} (or pi --fork ${inspectionSessionPath}).`]
         : [],
     });
     const approvalObjective = state.goal.objective;
-    const archived = archiveCurrentGoal(liveCtx, "complete", `auditor ${result.model} approved (${origin})`);
+    const archived = archiveCurrentGoal(liveCtx, "complete", `auditor ${result.model} approved (${origin})`, {}, { findingGroups: claim.findingGroups });
     if (!archived) {
       // archiveCurrentGoal already preserved the live record and warned the
       // user. Keep the approved claim recoverable, but never emit a terminal

package/extensions/loops/goal-orchestrator.ts

@@ -29,6 +29,7 @@ import { Type } from "typebox";
 import { state, replaceState, persistStateLine } from "../goal-state.js";
 
 import {
+  type FindingGroup,
   type Goal,
   type Policy,
   type State,
@@ -1099,6 +1100,9 @@ function archiveCurrentGoal(
   status: Status,
   stopReason?: string,
   patch: Partial<Pick<Goal, "auditHistory" | "completionSummary" | "pendingTasks">> = {},
+  // v0.38.50: agent-structured finding groups ride the audited claim into
+  // the archive rich section only — abort/wip paths omit it (flat fallback).
+  opts?: { findingGroups?: FindingGroup[] },
 ): boolean {
   if (!state.goal) return false;
   if (status !== "complete" && status !== "aborted") return false;
@@ -1147,7 +1151,7 @@ function archiveCurrentGoal(
   // it carries the same rich markdown as chat over the verbatim
   // six-label machine record. Built from the terminal goal AFTER the
   // summary fence resolves, so chat and archive cannot disagree.
-  const richSection = buildRichArchiveSection(terminalGoal, status, archivePath);
+  const richSection = buildRichArchiveSection(terminalGoal, status, archivePath, opts?.findingGroups);
   const richMd = `${md}\n## Terminal summary\n\n${richSection.join("\n")}\n`;
   // An existing same-id archive is an immutable fence. Check it before
   // publishing an intent so an unrelated/sentinel winner can never make the

package/extensions/loops/goal-tools.ts

@@ -133,6 +133,7 @@ isGoalRevisionCurrent,
   type DurableChoiceRecord,
   buildDurableChoiceRecord,
   normalizeDurableDeferRecommendationInput,
+  sanitizeFindingGroups,
 } from "../goal-loop-core.js";
 import {
   applyValidatedBatch,
@@ -536,6 +537,18 @@ function registerAgentTools(pi: any): void {
           "Renders as the closing `• Left out:` bullet in the user-facing terminal summary. " +
           "Omit when nothing was deliberately left out — absent stays absent, never invented.",
       })),
+      findingGroups: Type.Optional(Type.Array(Type.Object({
+        title: Type.String({ maxLength: 120, description: "Work-area name (e.g. a subsystem, screen, or phase)" }),
+        findings: Type.Array(Type.String({ maxLength: 500 }), { maxItems: 6, description: "Findings in this area as `Lead: body with path:line evidence` (max 6 per area)" }),
+      }), {
+        maxItems: 6,
+        description:
+          "v0.38.50: optional finding groups for the terminal summary. Group multi-area work by area " +
+          "(subsystem, screen, phase); each finding is `Lead: body` with repo-relative `path:line` evidence tokens. " +
+          "4+ groups render as an Area | Finding | Evidence table, fewer as nested area sections. " +
+          "Presentation only — the six-label completionSummary stays the audited substance, and file:line tokens are never invented. " +
+          "Omit for single-area work — the flat six-label render stays the fallback.",
+      })),
     }),
     async execute(_id, params, signal, _onUpdate, execCtx) {
       const foreign0 = foreignToolGuard(execCtx);
@@ -559,7 +572,7 @@ function registerAgentTools(pi: any): void {
         }
         return { content: [{ type: "text", text: `No active goal — it is ${state.goal.status}.` }], details: {} };
       }
-      const p = params as { completionSummary?: string; verificationSummary?: string; newObjective?: string; leftOut?: string };
+      const p = params as { completionSummary?: string; verificationSummary?: string; newObjective?: string; leftOut?: string; findingGroups?: unknown };
       if (state.goal.repairTarget) {
         return {
           content: [{ type: "text", text: `This repair card cannot be completed yet. Redraft the original target as a confirmed task list with propose_task_list (include objective: ${state.goal.repairTarget.objective.slice(0, 180)}), then continue the real work.` }],
@@ -772,12 +785,16 @@ function registerAgentTools(pi: any): void {
       if (!guardGoalBeforeContinuation(ctx, "completion-audit-dispatch", state.goal?.id)) {
         return staleToolResult();
       }
+      // v0.38.50: agent-structured finding groups ride the same claim —
+      // sanitized once at the boundary, rendered only after approval.
+      const sanitizedGroups = sanitizeFindingGroups(p.findingGroups);
       const completionClaim = beginCompletionAudit(ctx, {
         completionSummary: finalSummary,
         verificationSummary: p.verificationSummary,
         // v0.38.37: the deliberate non-do rides the pending claim into
         // the terminal render — the only source the summary may cite.
         ...(p.leftOut?.trim() ? { leftOut: p.leftOut.trim().slice(0, 500) } : {}),
+        ...(sanitizedGroups ? { findingGroups: sanitizedGroups } : {}),
         at: nowIso(),
       }, "complete-goal");
       if (!completionClaim) {
@@ -1232,7 +1249,9 @@ function registerAgentTools(pi: any): void {
       if (result.error === "Auditor aborted.") {
         // v0.38.37: capture the agent-claimed non-do before the claim is
         // cleared below — the Esc-complete path renders the same voice.
+        // v0.38.50: same for agent-structured finding groups.
         const escLeftOut = state.goal.pendingCompletion?.leftOut;
+        const escFindingGroups = state.goal.pendingCompletion?.findingGroups;
         updateGoal({ status: "active", auditHistory: history, pendingCompletion: undefined, pauseReason: "audit aborted by user (Esc)" }, ctx);
         const abortConfirmCtx = freshCtxForGeneration(auditGeneration);
         if (!abortConfirmCtx) return staleToolResult();
@@ -1274,8 +1293,9 @@ function registerAgentTools(pi: any): void {
             // v0.38.37: the claim was cleared pre-confirm; the non-do was
             // captured from it above.
             ...(escLeftOut ? { leftOut: escLeftOut } : {}),
+            ...(escFindingGroups ? { findingGroups: escFindingGroups } : {}),
           });
-          if (!archiveCurrentGoal(ctx, "complete", terminalReason)) {
+          if (!archiveCurrentGoal(ctx, "complete", terminalReason, {}, { findingGroups: escFindingGroups })) {
             return {
               content: [{ type: "text", text: "The audit was aborted, but the terminal archive could not be persisted. The goal remains active; fix persistence and retry." }],
               details: {},
@@ -1330,13 +1350,15 @@ function registerAgentTools(pi: any): void {
           record: manualArchiveRecord,
           // v0.38.37: the deliberate non-do rides the durable claim.
           ...(durableCompletionClaim.leftOut ? { leftOut: durableCompletionClaim.leftOut } : {}),
+          // v0.38.50: agent-structured finding groups ride the same claim.
+          ...(durableCompletionClaim.findingGroups ? { findingGroups: durableCompletionClaim.findingGroups } : {}),
           extras: inspectionSessionPath
             ? [`Auditor session kept for review: pi --session ${inspectionSessionPath} (or pi --fork ${inspectionSessionPath}).`]
             : [],
         });
         const manualObjective = state.goal.objective;
         const manualGoalId = state.goal.id;
-        const archived = archiveCurrentGoal(ctx, "complete", terminalReason);
+        const archived = archiveCurrentGoal(ctx, "complete", terminalReason, {}, { findingGroups: durableCompletionClaim.findingGroups });
         if (!archived) {
           // The archive helper preserves the live objective and emits the
           // persistence warning. Stop here: an approved verdict is not a
@@ -2213,9 +2235,14 @@ function registerAgentTools(pi: any): void {
       const tl = state.goal.taskList;
       // v0.38.48: copy-swap — the live list is never mutated in place, so a
       // kill between verify and persist (or a persist failure) cannot leave
-      // partial state. Message strings are unchanged (pinned by tests).
+      // partial state. Message strings are pinned by
+      // tests/task-atomicity-gate.test.ts.
       const t = findTask(tl, p.id);
-      if (t && t.status !== "complete") {
+      if (!t) return { content: [{ type: "text", text: `Task ${p.id} not found.` }], details: {} };
+      // v0.38.49 audit: an existing but already-complete task is a state
+      // fact, not a typo — report it instead of the not-found fallthrough.
+      if (t.status === "complete") return { content: [{ type: "text", text: `Task ${p.id} is already complete.` }], details: {} };
+      if (t) {
         const checkRes = await verifyTaskMilestone(ctx, t.verificationContract, signal);
         if (checkRes) {
           return {
@@ -2231,7 +2258,6 @@ function registerAgentTools(pi: any): void {
         }
         return { content: [{ type: "text", text: `Task ${p.id} marked complete.` }], details: {} };
       }
-      return { content: [{ type: "text", text: `Task ${p.id} not found.` }], details: {} };
     },
   }));
 
@@ -2253,8 +2279,13 @@ function registerAgentTools(pi: any): void {
         return { content: [{ type: "text", text: "No task list in this goal." }], details: {} };
       }
       const tl = state.goal.taskList;
-      // v0.38.48: copy-swap (see complete_task). Message strings unchanged.
+      // v0.38.48: copy-swap (see complete_task). Message strings are pinned
+      // by tests/task-atomicity-gate.test.ts.
       const t = findTask(tl, p.id);
+      if (!t) return { content: [{ type: "text", text: `Task ${p.id} not found.` }], details: {} };
+      // v0.38.49 audit: same-status moves are no-ops with a state-fact
+      // reply, not a persist round-trip reporting a change that happened.
+      if (t.status === p.status) return { content: [{ type: "text", text: `Task ${p.id} is already ${p.status}.` }], details: {} };
       if (t) {
         if (p.status === "complete") {
           const checkRes = await verifyTaskMilestone(ctx, t.verificationContract, signal);
@@ -2273,7 +2304,6 @@ function registerAgentTools(pi: any): void {
         }
         return { content: [{ type: "text", text: `Task ${p.id} → ${p.status}` }], details: {} };
       }
-      return { content: [{ type: "text", text: `Task ${p.id} not found.` }], details: {} };
     },
   }));
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-goal-list-loop-audit",
-  "version": "0.38.48",
+  "version": "0.38.50",
   "description": "Mission control for autonomous pi: interview-drafted goals, an audited task queue, and forever-loops (metric, spec, project-audit) that run for hours. A detached extension-less auditor process re-verifies every completion with raw evidence without holding the main pi turn; confirmed drafts, decision pauses and consent gates keep you in charge.",
   "license": "AGPL-3.0-only",
   "author": "dracon",

package/prompts/goal-loop-continuation.md

@@ -55,9 +55,9 @@ When a goal, list item, or pending task explicitly says `Agent: Designer`, `Role
 
 ## Available tools
 
-You have `read`, `write`, `edit`, `bash`, `grep`, `find`, `ls`, the `subagent` tool, and the goal toolkit (`propose_task_list`, `complete_task`, `update_task_status`, `record_goal_judgment`, `pause_goal`, `complete_goal`), plus the list tools (`list_add`, `list_status`, `list_activate`) — when the user asks to queue more work ("add these to my list", "queue these 10 things"), call `list_add` with the items; when unsure what is running or waiting, call `list_status`.
+You have `read`, `write`, `edit`, `bash`, `grep`, `find`, `ls`, the `subagent` tool, and the goal toolkit (`propose_task_list`, `complete_task`, `update_task_status`, `update_task_batch`, `record_goal_judgment`, `pause_goal`, `complete_goal`), plus the list tools (`list_add`, `list_status`, `list_activate`) — when the user asks to queue more work ("add these to my list", "queue these 10 things"), call `list_add` with the items; when unsure what is running or waiting, call `list_status`.
 
-If the objective decomposes into milestones and no task list exists yet, call `propose_task_list` early — the user confirms it, then you track progress with `complete_task` / `update_task_status` as you go (not in a batch at the end). Limits: 20 tasks, 5 subtasks per task.
+If the objective decomposes into milestones and no task list exists yet, call `propose_task_list` early — the user confirms it, then you track progress with `complete_task` / `update_task_status` / `update_task_batch` as you go (not as a post-hoc checklist at the end). For several status changes at once, prefer one `update_task_batch` call: the whole batch validates first, milestones verify, then all statuses persist in one write. Limits: 20 tasks, 5 subtasks per task.
 
 When the agent calls any of these, the orchestrator tracks the call and persists state to `.pi-glla/active.jsonl`.
 
@@ -156,6 +156,8 @@ Do NOT conclude "the loop is too eager" or "I am broken" before checking what a
 
 Use tasks as PROGRESS TRACKERS during your work — not as a post-hoc checklist to batch-mark at the end.
 
+Pending-task gate: `complete_goal` is refused BEFORE the auditor when committed tasks are still open — the refusal names each open task and sends nothing to the auditor. Finish them with `complete_task` / `update_task_batch`, or record an explicit deferral with `record_goal_judgment` (`choice="deferred"` + `taskId`) for a genuinely blocked item.
+
 Before deciding that the goal is achieved, perform a completion audit against the actual current state:
 
 - Restate the objective as concrete deliverables or success criteria.
@@ -174,7 +176,7 @@ recap and synthesizes a recorded-facts-only fallback at terminalization when a
 legacy or incomplete caller omits it; never invent a commit, changed file, or
 passing test to make the recap sound complete.
 
-Then call `complete_goal`. The orchestrator will spawn an **isolated auditor** in a fresh session to verify, and either accept (mark goal complete) or reject (continue work).
+Then call `complete_goal` — only with every committed task finished or explicitly deferred, otherwise the claim is refused before audit (see the pending-task gate above). The orchestrator will spawn an **isolated auditor** in a fresh session to verify, and either accept (mark goal complete) or reject (continue work).
 
 If your work has shifted to items different from the original objective (the original was blocked, higher-ROI items emerged): pass `newObjective` to `complete_goal` to atomically update the objective and audit against the NEW one — do NOT call `complete_goal` on the original objective after shipping different work, the auditor will disapprove because the original isn't shipped. Alternatively `pause_goal` proposing a `/goal tweak` if the shift needs the user's call.
 
@@ -203,4 +205,4 @@ The orchestrator's backstop is the stall watchdog: three consecutive turns with
 
 `complete_goal` submits a nonterminal claim, not a completion verdict. While the detached audit is pending, do not say the goal is done/complete/approved or present a final success summary. Do not wait or poll. If a response is needed, give one brief pending-status sentence. GLLA posts the concrete outcome-first summary into chat after verified approval and durable archive, without needing another user prompt. Do not duplicate that summary. A rejected claim remains unfinished and repair work continues.
 
-The agent-written completionSummary is user-facing evidence, not a step log: open with the outcome in plain words, then one verifiable result per label with its proof inline (test counts, file paths, commit refs) — never raw run stats. Keep each label value to one line of ~90 chars so every chat bullet fits without a trailing …; cite human-readable proof (counts, versions, repo-relative paths, PR numbers) and never machine paths (/var/tmp logs, tarballs — those live in the archive only). Cut values at clause boundaries, never mid-word; write Next: as one concrete follow-up action or none (audit-self-referential lines like "verdict decides" are stripped at render); pass what was deliberately left out as the complete_goal leftOut parameter — it renders as the closing bullet, and is omitted when absent.
+The agent-written completionSummary is user-facing evidence, not a step log: open with the outcome in plain words, then one verifiable result per label with its proof inline (test counts, file paths, commit refs) — never raw run stats. Keep each label value to one or two short clauses so it survives the renderer's clause-boundary clipping (rich sections budget ~200 chars per value); cite human-readable proof (counts, versions, repo-relative paths, PR numbers) and never machine paths (/var/tmp logs, tarballs — those live in the archive only). Cut values at clause boundaries, never mid-word; write Next: as one concrete follow-up action or none (audit-self-referential lines like "verdict decides" are stripped at render); pass what was deliberately left out as the complete_goal leftOut parameter — it renders as the closing bullet, and is omitted when absent. When the work spans distinct areas (subsystems, screens, phases), group the findings with the complete_goal findingGroups parameter — one group per area, each finding as `Lead: body` with repo-relative `path:line` evidence tokens (never invented paths); 4+ groups render as an Area | Finding | Evidence table, fewer as nested area sections. Single-area work omits findingGroups — the flat six-label render stays the fallback.