pi-goal-list-loop-audit 0.38.62 → 0.38.67

package/CHANGELOG.md

@@ -1,5 +1,103 @@
 # Changelog
 
+## 0.38.67 — Stop clobbering other extensions' compactions (2026-09-19)
+
+### session_before_compact returns nothing (issue #56, ezoushen)
+
+The `session_before_compact` handler ended with `return {}`, which under
+pi's last-truthy-wins handler semantics silently discarded a
+previously-run extension's `SessionBeforeCompactResult.compaction` — pi
+fell back to default compaction after the other extension had already paid
+for summarization. The handler only prunes the shared preparation by
+reference and arms the in-flight marker, so it now returns nothing, with a
+regression pin asserting no truthy object return.
+
+## 0.38.66 — Auditor reliability: eviction, mirrors, bounded waits (2026-09-19)
+
+### Dead-auditor eviction and identical-failure parking (audit-stuck batch)
+
+Detached-auditor failures that prove a model ref unresolvable (`Model not
+found` and synonyms) evict the ref from the candidate chain instead of
+retrying it forever. `resume_goal` runs the recovery probe inline rather
+than refusing while main-model recovery is pending. Three consecutive
+identical infra failures park the claim `blocked` with a named chain and a
+structured fingerprint instead of spinning. Parked-queue duplicates coalesce
+instead of piling up, and queued retries drain rather than jam the list head.
+
+### Session-identity refusal fix (field 195237)
+
+Subagent-session confusion is gone: foreign-context detection compares
+session identity, not object identity, so a worker in the same session is
+no longer refused as foreign.
+
+### Bounded agent load waits (field 153404)
+
+Far-future agent `pause_goal kind="wait"` requests are clamped to one hour
+with a visible notice instead of parking for 4+ hours unchecked.
+
+### Tweak keeps provenance raw (field 184316)
+
+`/goal tweak` strips the procedural tail before extracting the verification
+contract while keeping the raw user seed, so filings say what was done
+without laundering what was asked.
+
+### Relentless provider retry within bounds (fields 200751/200754)
+
+Provider failures keep hammering within the recovery envelope: both
+error-brake callbacks anchor on the recovery episode key instead of matching
+reason strings, so a self-park no longer disarms an armed retry. Genuine
+user pauses and decision-picker stand-downs still stand down.
+
+### No mid-objective parking while recovery is armed
+
+Agent `error`/`blocked` park requests are refused with routing text while
+provider recovery is armed, and ledgered — the run must not stop
+mid-objective unless it must. Decision waits, genuine blockers, and user
+pauses are untouched.
+
+### Suspicious-goal close (field 032245)
+
+A goal paused only by the suspicious-objective dispatch shield can now close
+via `complete_goal`: the accept path verifies artifacts through the isolated
+auditor and voids the queued repair on approval. User pauses and repair
+cards (`repairTarget`) still refuse as before.
+
+### Standby pause for background agents (field 021655)
+
+New structured `standby` pause kind for waits on background agents — the
+card and status line say waiting (not blocked), and completion wakes
+automatically. `blocked`/`error` rendering is unchanged.
+
+### Post-drafting stuck paths fixed
+
+Persist-failed completion claims report error instead of fake pending;
+auditor-retry waits are capped at 15 minutes; recovery waits name the agent
+path (`resume_goal` retries now). After drafting, the loop no longer gets
+stuck short of completion.
+
+### Auditor mirrors session extensions (field 151158)
+
+The detached auditor inherits the session's extension packages by default
+(tri-state `auditorMirrorSessionExtensions`, on unless explicitly off), so a
+session-resolved auditor model ref no longer dies as `Model not found` in
+the isolated worker. GLLA never mirrors itself; unresolvable specs drop
+fail-closed; the read-only tool fence is unchanged.
+
+### Fallback chains offer the thinking pick (field 152226)
+
+Saving a non-empty auditor fallback chain now offers the thinking-level pick
+(the agnes-flash selection sticks), and typing the session model into the
+fallback input names the slot-0 exclusion instead of silently clearing.
+Clearing the chain skips the thinking prompt.
+
+### Goal-aware length continuation (PR #55, FOF11)
+
+When an active goal's response is truncated at the output-token limit, the
+continuation text first asks whether the goal is already satisfied — calling
+`complete_goal` if so — instead of starting another blind work pass. Plain
+sessions keep the generic text; marker and retry payload follow the text
+actually sent.
+
 ## 0.38.62 — Whole-note verification aggregation (2026-09-17)
 
 ### Conservative result parsing

package/README.md

@@ -421,7 +421,8 @@ Open `/glla` for the settings table. The most important choices are:
   unset, auditor thinking inherits the parent session dial (including `max`);
 - **Main-agent and auditor fallback models:** both roles use the same ordered,
   deselectable, bounded fallback-chain picker for provider failures; the
-  auditor's session model remains the final last resort;
+  auditor's session model remains the final last resort. Saving a non-empty
+  auditor chain also offers the thinking-level pick so the selection sticks;
 - **Auto-resume:** whether persisted work may restart automatically after a
   session loads; explicit resume commands are always available;
 - **State root:** `workingDir` by default, opt-in `sessionDir`;
@@ -442,10 +443,12 @@ supervisor.
 ## Model and auditor requirements
 
 The main agent may use the model/provider you normally use in pi. The detached
-auditor starts a fresh extension-less pi process by default, so its selected
-model must authenticate and work without an extension-registered provider.
-Choose an auditor model in `/glla` if the session model depends on a provider
-extension.
+auditor starts a fresh pi process that mirrors your session's extension
+packages by default, so session-resolved models (including
+provider-extension models) work there too; disable the mirror in `/glla`
+settings if you want the fully isolated extension-less auditor. Choose an
+auditor model in `/glla` if the session model depends on something the
+worker cannot reach.
 
 The worker inherits normal pi provider configuration and resolves `pi` from
 `PATH`. If needed, set:

package/docs/INDEX.md

@@ -16,7 +16,7 @@ Policy contracts and recent changes live in the `audit/` directory of the
   failback; v0.35.9 hardened cross-version npm tarball checks; v0.35.10
   handles multi-entry npm dry-run reports; v0.35.11 accepts both npm report
   shapes; v0.35.12 supports npm 12's keyed pack reports; v0.35.13 fixes stale-API recovery loops.
-  v0.35.14–v0.38.62 continue through the supervisor freeze (`/glla pause`),
+  v0.35.14–v0.38.67 continue through the supervisor freeze (`/glla pause`),
   load hold, auditor picker parity, Windows launch fix, zombie-watchdog
   subagent carve-out, due-wait backstop, the `/glla agents` visibility panel,
   durable state-root selection, blank-until-resume auditor context, frozen

package/docs/SETTINGS.md

@@ -50,8 +50,9 @@ copies are ignored (the recovery runtime reads the global file):
 | `blockForbiddenModelSwitches` | `true` | Revert forbidden switches (`false` = stand but ledger). |
 | `visionAssist` | `true` | Continuation prompts carry the prefer-native-vision directive. |
 | `auditorModel` | unset (session) | Detached auditor primary (`"provider/id"` or bare id). |
-| `auditorModelFallbacks` | `[]` | Ordered auditor fallbacks; session model is final. Global-only. |
+| `auditorModelFallbacks` | `[]` | Ordered auditor fallbacks; session model is final. Saving a non-empty chain offers the thinking pick. Global-only. |
 | `auditorAllowedExtensions` | `[]` | Extension specs the detached auditor may load; resolved fail-closed, `[]` = isolated. |
+| `auditorMirrorSessionExtensions` | `true` | Also load the session's own packages in the worker (GLLA itself never mirrored); `false` = curated allow-list only. |
 | `auditorSameSessionSwap` | `true` | Walk the fallback chain when the auditor is the session model. |
 | `auditorThinkingLevel` | unset (inherit) | Detached auditor reasoning level; picked with the model. |
 | `auditorToolTimeoutMs` | `300000` | Base budget per auditor tool call (30s–6h). Global-only. |

package/extensions/auditor-extensions.ts

@@ -35,6 +35,7 @@
 
 import * as fs from "node:fs";
 import * as path from "node:path";
+import { fileURLToPath } from "node:url";
 
 /** One extension the user could allow-list for the auditor. */
 export interface DiscoveredPiExtension {
@@ -185,6 +186,95 @@ export function resolveAuditorAllowedExtensions(
   return out;
 }
 
+/** v0.38.65 (field 151158): repo root of THIS extension — the session
+ * mirror must never feed GLLA back into its own detached worker (an
+ * auditor loading the goal toolkit could re-dispatch goals). Exported
+ * for tests; the mirror filter is the real consumer. */
+export function gllaRepoRoot(): string {
+  return path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
+}
+
+/** v0.38.65: true when a mirror candidate is GLLA itself — by package
+ * name (no filesystem touch; covers npm: specs and relative paths on
+ * machines where the install lives under a different path) or by
+ * resolved path inside this repo (covers relative-path specs pointing
+ * here under an unfamiliar spelling). */
+export function isSelfMirrorSpec(raw: string, opts: { home: string; cwd?: string }): boolean {
+  const trimmed = raw.trim();
+  if (!trimmed) return false;
+  if (/pi-goal-list-loop-audit/i.test(labelForSpec(trimmed))) return true;
+  const root = gllaRepoRoot();
+  const bases = [path.join(opts.home, ".pi", "agent"), ...(opts.cwd ? [path.join(opts.cwd, ".pi")] : [])];
+  for (const base of bases) {
+    const resolved = resolveAuditorExtensionSpec(trimmed, { home: opts.home, cwd: opts.cwd, base });
+    if (resolved && (resolved === root || resolved.startsWith(root + path.sep))) return true;
+  }
+  return false;
+}
+
+/** v0.38.65 (field 151158): raw session package specs to mirror into the
+ * detached auditor — user settings packages[]/extensions[] first, then
+ * project settings. Raw strings, not resolved paths: the process layer
+ * resolves them fail-closed at dispatch, so an entry that vanishes
+ * between mirror and spawn simply drops out. GLLA itself is excluded.
+ * Read-only and best-effort like the rest of discovery: unreadable
+ * settings files contribute nothing. */
+export function sessionMirrorExtensionSpecs(home: string, cwd?: string): string[] {
+  const out: string[] = [];
+  const seen = new Set<string>();
+  const push = (raw: string): void => {
+    const spec = raw.trim();
+    const key = spec.toLowerCase();
+    if (!spec || seen.has(key)) return;
+    if (isSelfMirrorSpec(spec, { home, cwd })) return;
+    seen.add(key);
+    out.push(spec);
+  };
+  for (const raw of readJsonArray(path.join(home, ".pi", "agent", "settings.json"))) push(raw);
+  if (cwd) {
+    for (const raw of readJsonArray(path.join(cwd, ".pi", "settings.json"))) push(raw);
+  }
+  return out;
+}
+
+/** v0.38.65: union the curated allowlist with the session mirror — user
+ * entries first (first spelling wins, case-insensitive), then mirrored
+ * session specs. Mirror off restores the pre-mirror behavior exactly:
+ * the curated allowlist alone, possibly empty (fully isolated). Bounded
+ * like the allowlist itself. */
+export function mergeAuditorAllowedExtensions(
+  user: string[] | undefined,
+  mirror: string[],
+  mirrorEnabled: boolean,
+): string[] {
+  const base = normalizeAuditorAllowedExtensions(user);
+  if (!mirrorEnabled) return base;
+  const seen = new Set(base.map((entry) => entry.toLowerCase()));
+  const out = [...base];
+  for (const entry of normalizeAuditorAllowedExtensions(mirror)) {
+    if (seen.has(entry.toLowerCase())) continue;
+    seen.add(entry.toLowerCase());
+    out.push(entry);
+  }
+  return out;
+}
+
+/** v0.38.65 (field 151158): dispatch-time allowlist — the curated
+ * setting union the session package mirror, unless the user explicitly
+ * opted out (auditorMirrorSessionExtensions === false). Both dispatch
+ * paths (complete_goal launch + provider-retry re-seed) call this so
+ * provider parity between session and worker stays identical. */
+export function dispatchAuditorAllowedExtensions(
+  user: string[] | undefined,
+  mirrorSetting: boolean | undefined,
+  home: string,
+  cwd?: string,
+): string[] {
+  const enabled = mirrorSetting !== false;
+  const mirror = enabled ? sessionMirrorExtensionSpecs(home, cwd) : [];
+  return mergeAuditorAllowedExtensions(user, mirror, enabled);
+}
+
 /** Bounded, deterministic normalization of the allowlist value.
  * Audit 2026-09-06: dedup is case-insensitive like the model fallback
  * chains (npm names cannot differ by case; a same-case pair is always the

package/extensions/auditor-thinking.ts

@@ -0,0 +1,16 @@
+/** Resolve the auditor dial against each selected candidate, not just the primary.
+ * Old settings keep their meaning: unset inherits the session dial. Unsupported
+ * levels fall downwards; a non-reasoning model always gets off. */
+export function resolveAuditorThinkingLevel(model: { reasoning?: boolean; thinkingLevelMap?: Record<string, string | null> } | undefined, requested: string): string {
+  const levels = ['off', 'minimal', 'low', 'medium', 'high', 'xhigh', 'max'];
+  if (!model?.reasoning) return 'off';
+  const ceiling = levels.indexOf(requested);
+  const start = ceiling < 0 ? levels.indexOf('high') : ceiling;
+  for (let index = start; index >= 0; index--) {
+    const level = levels[index]!;
+    const mapped = model.thinkingLevelMap?.[level];
+    if (mapped === null || ((level === 'xhigh' || level === 'max') && mapped === undefined)) continue;
+    return level;
+  }
+  return 'off';
+}

package/extensions/drafting-handoff.ts

@@ -1,7 +1,25 @@
-/** Observes a narrow, positively identified unfinished drafting handoff.
- * Silence and punctuation alone are never evidence that a user wait is
- * broken. The caller owns lifecycle-fenced, once-only dispatch.
+/** Observes an unfinished drafting handoff: a list/goal/loop drafting
+ * turn that ends with commentary alone. The grill guidance is in effect
+ * for the whole episode, so every drafting turn must end with a presented
+ * picker, a stated next dependent question, or a concrete proposal — a
+ * stop turn with substantive question-less commentary strands the user
+ * (field 125335) exactly like the old dangling-intro shape it subsumes.
+ * Silence, punctuation, and short acks alone are never evidence that a
+ * user wait is broken. The caller owns lifecycle-fenced, once-only dispatch.
  */
+const DRAFT_COMMENTARY_FLOOR = 40;
+// A stated next dependent question is a legal drafting end — only
+// commentary ALONE corrects. Keep tight: will-ask, next-question, and
+// after-you-answer phrasing, never a bare "ask"/"question" mention
+// (promising questions without stating the next one is the bug).
+const STATED_NEXT_QUESTION_RE = new RegExp(
+  [
+    String.raw`\b(i[''’]ll|i will|let me)\b[^.!?]{0,100}\bask\b`,
+    String.raw`\bnext\b[^.!?]{0,60}\bquestions?\b`,
+    String.raw`\b(after|once)\b[^.!?]{0,60}\b(you (answer|reply)|your answer)\b`,
+  ].join("|"),
+  "i",
+);
 export class DraftingHandoffObserver {
   private answered = false;
   private notified = false;
@@ -11,7 +29,12 @@ export class DraftingHandoffObserver {
 
   reset(): void {
     this.invalidate();
-    this.answered = false;
+    // A fresh drafting episode opens armed: the grill guidance is in
+    // effect from turn one, so a commentary-only end strands the user
+    // with or without prior Q&A (field 125335 had none to rely on).
+    // Picker-outstanding, proposal-presented, and cancelled-picker turns
+    // still disarm via noteToolResult below.
+    this.answered = true;
     this.notified = false;
   }
 
@@ -27,11 +50,13 @@ export class DraftingHandoffObserver {
 
   observe(text: string, stopReason: string | undefined): boolean {
     if (!this.answered || this.notified || stopReason !== "stop") return false;
-    const lastLine = text.trim().split("\n").at(-1)?.trim() ?? "";
-    // Match the field screenshot's dangling introduction, not a real
-    // question, imperative request, option list, or arbitrary short reply.
-    if (!/^(?:two|three|four|[2-4]) (?:final |remaining )?(?:policy )?(?:choices|questions|decisions) (?:will|would) make (?:the |our )?(?:implementation )?(?:contract|scope|plan) concrete:\s*$/i.test(lastLine)) return false;
-    if (text.includes("?")) return false;
+    const trimmed = text.trim();
+    // A real prose question waits without an autonomous retry.
+    if (trimmed.includes("?")) return false;
+    // Short acks are not substantive commentary.
+    if (trimmed.length < DRAFT_COMMENTARY_FLOOR) return false;
+    // A stated next dependent question ends the turn legally.
+    if (STATED_NEXT_QUESTION_RE.test(trimmed)) return false;
     this.notified = true;
     this.answered = false;
     return true;

package/extensions/faulty-objective-recovery.ts

@@ -8,6 +8,25 @@
 
 import type { Goal, ObjectiveRepairRecord } from "./goal-loop-core.js";
 
+/** Prefix written by the dispatch guard when it parks a goal/list item
+ * whose objective prose tripped the fragment heuristics. Exported so the
+ * complete_goal close path can recognize exactly this pause shape without
+ * re-parsing prose. */
+export const SUSPICIOUS_PAUSE_PREFIX = "Suspicious objective detected (";
+
+/** A suspicious-objective pause is a dispatch shield, not a work stop:
+ * the objective prose looked like report garbage, so the worker model must
+ * not be dispatched — but a completion claim carries evidence to the
+ * isolated auditor, which verifies real artifacts. Callers use this to keep
+ * the close path open on exactly this pause shape. */
+export function isSuspiciousObjectivePause(
+  goal: Pick<Goal, "pauseKind" | "pauseReason">,
+): boolean {
+  return goal.pauseKind === "blocked"
+    && typeof goal.pauseReason === "string"
+    && goal.pauseReason.startsWith(SUSPICIOUS_PAUSE_PREFIX);
+}
+
 export type SuspiciousObjectiveReason =
   | "empty"
   | "archive-metadata"

package/extensions/goal-commands.ts

@@ -14,7 +14,7 @@ import { renderAgentsPanel, tailChildTranscript, TRANSCRIPT_HEADER_SCAN_MAX_BYTE
 import { state, replaceState } from "./goal-state.js";
 import {
   DEFAULT_TOKEN_LIMIT, Goal, ListItem, Status, appendLedger, archiveDir, archivedGoalPath, bumpGoalRevision, sanitizeProviderDisplayText,
-  computeListDepthFromLedger, clearQueueItemFiles, deleteQueueItemFile, deleteQueueItemFileResult, extractVerificationContract, formatAuditLog, formatGoalAuditHistory, formatMainModelRecoveryStatus, queueItemSidecarCount,
+  computeListDepthFromLedger, clearQueueItemFiles, deleteQueueItemFile, deleteQueueItemFileResult, extractVerificationContract, stripTweakProceduralTail, formatAuditLog, formatGoalAuditHistory, formatMainModelRecoveryStatus, queueItemSidecarCount,
   formatListDepth, goalArgsNeedDrafting, ledgerPath, newGoalId, nowIso, parseListImport, parseListItemDeclaration, readLedgerTail,
   assignQueueOrder, compareQueueItems, readAuditLog, readQueueFromDisk, routeGoalArgs, routeListText, sanitizeDisplayText, sanitizeProviderAuditReport, statusLabel,
   visibleListPosition, visibleListPositions,
@@ -231,6 +231,14 @@ async function cmdGoal(args: string, ctx: ExtensionContext): Promise<void> {
         ctx.ui.notify("An audit is already running…", "info");
         return;
       }
+      // Pending-claim lifecycle: a stored claim awaiting its verdict owns
+      // the goal surface. Verify reports the awaiting state instead of
+      // destroying the healthy claim and relaunching blindly — the
+      // in-process flag above only covers audits owned by this process.
+      if (state.goal.status === "auditing" && state.goal.pendingCompletion) {
+        ctx.ui.notify(`A completion audit is already awaiting its verdict — wait for it or ${activeGoalSurfaceCommand("cancel")} to discard the pending claim and start over.`, "info");
+        return;
+      }
       updateGoal({
         pendingCompletion: {
           completionSummary: "Manual audit requested by the user via /goal verify (no agent completion claim). Verify the objective against the repo directly.",
@@ -825,7 +833,12 @@ export async function cmdTweak(
     ctx.ui.notify(guidance, "info");
     return false;
   }
-  const proposed = extractVerificationContract(adopted);
+  // Now 184316: strip the trailing procedural tail BEFORE contract
+  // extraction — a replacement ending in filing instructions plus an
+  // embedded command ("Ensure both objective and verification contract
+  // are updated, then /goal resume.") must file the said work, not the
+  // instructions about the filing. userSeeds below keeps the said words.
+  const proposed = extractVerificationContract(stripTweakProceduralTail(adopted));
   const newObjective = proposed.objective;
   if (!newObjective) {
     // (a bare input of "Done when: ..." only yields this — the replacement
@@ -1060,6 +1073,32 @@ export function hydrateListQueueFromDisk(ctx: ExtensionContext): number {
   return recovered.length;
 }
 
+/** v0.38.63 (audit-stuck batch, field 124536): while the head goal is
+ * parked, re-adding an objective that is already queued — or duplicated
+ * inside the same batch — coalesces instead of piling up. Pure; both add
+ * funnels (direct + batch) call it with the live queue. */
+export function splitParkedQueueDuplicates(texts: string[], queuedObjectives: Array<string | undefined>): { fresh: string[]; coalesced: string[] } {
+  const seen = new Set<string>();
+  for (const objective of queuedObjectives) {
+    if (typeof objective === "string" && objective.trim()) seen.add(normalizeObjective(objective));
+  }
+  const fresh: string[] = [];
+  const coalesced: string[] = [];
+  for (const text of texts) {
+    let key = "";
+    try {
+      key = normalizeObjective(parseListItemDeclaration(text).objective);
+    } catch { /* unparseable — the funnel below refuses it with its own copy */ }
+    if (key && seen.has(key)) {
+      coalesced.push(text);
+      continue;
+    }
+    if (key) seen.add(key);
+    fresh.push(text);
+  }
+  return { fresh, coalesced };
+}
+
 function enqueueItems(ctx: ExtensionContext, texts: string[], source: string, opts?: { autoActivate?: boolean }): number {
   hydrateListQueueFromDisk(ctx);
   const recentlyDone = recentlyCompletedObjectives(ctx.cwd);
@@ -1071,7 +1110,19 @@ function enqueueItems(ctx: ExtensionContext, texts: string[], source: string, op
     ctx.ui.notify(`Skipped ${skipped} item(s) duplicating work COMPLETED in the last 24h (zombie-twin guard): ${first.slice(0, 90)}`, "warning");
   }
   if (fresh.length === 0) return 0;
-  const items = fresh.map((text) => {
+  // v0.38.63 (audit-stuck batch, field 124536): while parked, duplicates
+  // of waiting work coalesce — the queue must not grow without progress.
+  let toQueue = fresh;
+  if (state.goal?.status === "paused") {
+    const split = splitParkedQueueDuplicates(fresh, listQueue().map((item) => item.objective));
+    if (split.coalesced.length > 0) {
+      appendLedger(ctx.cwd, "list_parked_duplicate_coalesced", { source, count: split.coalesced.length, objective: split.coalesced[0]!.slice(0, 200), queueDepth: listQueue().length });
+      ctx.ui.notify(`Coalesced ${split.coalesced.length} item(s) already waiting behind the paused head — queue depth holds at ${listQueue().length}.`, "info");
+    }
+    toQueue = split.fresh;
+    if (toQueue.length === 0) return 0;
+  }
+  const items = toQueue.map((text) => {
     const extracted = parseListItemDeclaration(text);
     return {
       id: newGoalId(),
@@ -1146,6 +1197,11 @@ function enqueueItems(ctx: ExtensionContext, texts: string[], source: string, op
   appendLedger(ctx.cwd, "list_queue_disk_first", { source, count: itemsToWrite.length, diskFirst });
   persistState(ctx);
   appendLedger(ctx.cwd, "list_imported", { source, count: itemsToWrite.length });
+  if (state.goal?.status === "paused") {
+    // v0.38.63 (audit-stuck batch, field 124536): a parked head queues
+    // silently today — the pile-up grows invisibly. Name the jam + depth.
+    ctx.ui.notify(`Queued ${itemsToWrite.length} item(s) behind the paused head (${listQueue().length} waiting) — ${state.goal.pauseSuggestedAction ?? "resume the head to continue"}.`, "info");
+  }
   if (!state.goal || state.goal.status === "complete" || state.goal.status === "aborted") {
     // v0.28.28: unsolicited sources (the reviewer) do NOT auto-start the
     // head unless autoResume is on — "I cancelled a goal and the next one
@@ -1663,8 +1719,19 @@ async function cmdList(args: string, ctx: ExtensionContext): Promise<void> {
 }
 
 /** Append one objective to the list; activate immediately when idle. */
+/** v0.38.63 (audit-stuck batch, field 124536): parked-coalesce early-out
+ * for the direct funnel — true when the add merged into waiting work. */
+function coalesceParkedDuplicate(ctx: ExtensionContext, raw: string): boolean {
+  if (state.goal?.status !== "paused") return false;
+  if (splitParkedQueueDuplicates([raw], listQueue().map((item) => item.objective)).coalesced.length === 0) return false;
+  appendLedger(ctx.cwd, "list_parked_duplicate_coalesced", { source: "direct", count: 1, objective: raw.slice(0, 200), queueDepth: listQueue().length });
+  ctx.ui.notify(`Already waiting behind the paused head — coalesced, queue depth holds at ${listQueue().length}.`, "info");
+  return true;
+}
+
 function addSingleItem(ctx: ExtensionContext, raw: string): void {
   hydrateListQueueFromDisk(ctx);
+  if (coalesceParkedDuplicate(ctx, raw)) return;
   const extracted = parseListItemDeclaration(raw);
   const item = assignQueueOrder([{
     id: newGoalId(),

package/extensions/goal-continuation.ts

@@ -67,7 +67,7 @@ import {
   type ContinuationDispatch,
 } from "./goal-loop-dispatch.js";
 import { BACKOFF_IDLE_RETRY_MS, HEARTBEAT_MAX_NUDGES } from "./goal-loop-backoff.js";
-import { LENGTH_CONTINUE_MAX, LENGTH_CONTINUE_TEXT } from "./length-continue.js";
+import { GOAL_LENGTH_CONTINUE_TEXT, LENGTH_CONTINUE_MAX, LENGTH_CONTINUE_TEXT } from "./length-continue.js";
 
 // v0.38.0: GLLA_MONITOR_INTERVAL_MS throttling is deprecated — scheduling is
 // event-driven (250ms→15s adaptive fallback) for every plane, including
@@ -86,7 +86,7 @@ import { readHandoffBriefExcerpt } from "./goal-compactor.js";
 import { loadSettings } from "./goal-settings.js";
 import { clearLoopTimer, isLoopActive } from "./goal-loop.js";
 import { attemptFreshSessionRecovery, mainModelRecoveryActive, recoverMainModelFromSendStorm } from "./goal-recovery.js";
-import { sendStormEscalateMs } from "./main-model-recovery.js";
+import { isCompactionInFlightSince, sendStormEscalateMs } from "./main-model-recovery.js";
 import {
   appendObjectiveRepairRecord,
   applyObjectiveRepair,
@@ -95,6 +95,7 @@ import {
   buildRepairTaskObjective,
   deriveObjectiveRepair,
   hasQueuedObjectiveRepair,
+  SUSPICIOUS_PAUSE_PREFIX,
 } from "./faulty-objective-recovery.js";
 
 /** goal.ts-owned module lets the continuation cluster reads/writes through
@@ -130,8 +131,8 @@ export interface ContinuationFlags {
   get loopRearmMilestone(): number;
   set loopRearmMilestone(v: number);
   get completionAuditInFlight(): boolean;
+  get compactionInFlightSince(): number | null;
 }
-
 /** goal.ts functions/consts the continuation cluster calls. Wired by goal.ts
  * at factory time. */
 export interface ContinuationDeps {
@@ -410,8 +411,15 @@ export function accountSendRearm(ctx: ExtensionContext, kind: "continuation" | "
     }
   }
   if (elapsed >= sendStormEscalateMs() && Date.now() - flags.lastActivityAt >= SEND_REARM_ESCALATE_SILENT_MS) {
-    if (kind === "continuation") { continuationRearmStreak = 0; continuationRearmSince = 0; } else { flags.loopRearmStreak = 0; flags.loopRearmSince = 0; }
-    escalateSendRearmStorm(ctx, kind);
+    // In-flight auto-compaction is legitimate busy time (field 083546) —
+    // its silence must not read as a stuck send queue. Suppress the
+    // escalation (and its recovery park) until the post-compact settle.
+    if (isCompactionInFlightSince(flags.compactionInFlightSince)) {
+      appendLedger(ctx.cwd, "send_rearm_escalated_suppressed", { reason: "compaction-in-flight", kind, streak, elapsedMinutes: Math.round(elapsed / 60000) });
+    } else {
+      if (kind === "continuation") { continuationRearmStreak = 0; continuationRearmSince = 0; } else { flags.loopRearmStreak = 0; flags.loopRearmSince = 0; }
+      escalateSendRearmStorm(ctx, kind);
+    }
   }
 }
 
@@ -946,9 +954,14 @@ export function guardGoalBeforeContinuation(
   ctx: ExtensionContext,
   where: string,
   expectedGoalId?: string,
-  options: { allowAuditing?: boolean } = {},
+  options: { allowAuditing?: boolean; allowSuspiciousClose?: boolean } = {},
 ): boolean {
   const allowAuditing = options.allowAuditing === true;
+  // v0.38.63 (field 032245): a completion-claim settlement never dispatches
+  // the objective prose to a worker — the isolated auditor verifies real
+  // artifacts. allowSuspiciousClose skips ONLY the suspicious-objective
+  // pause branch below; every other fence (terminal, archive, stale,
+  // replan) still applies.
   const goal = state.goal;
   if (!goal) return false;
   if (expectedGoalId && goal.id !== expectedGoalId) {
@@ -1024,6 +1037,15 @@ export function guardGoalBeforeContinuation(
 
   const assessment = assessSuspiciousObjective(goal.objective, goal.verificationContract);
   if (!assessment.suspicious) return true;
+  if (options.allowSuspiciousClose === true) {
+    appendLedger(ctx.cwd, "faulty_objective_suspicious_close_allowed", {
+      goalId: goal.id,
+      where,
+      reasons: [...assessment.reasons],
+      note: "completion-claim settlement verifies artifacts, never dispatches the objective; suspicious-objective pause skipped",
+    });
+    return true;
+  }
   // v0.35.31 (field: Screenshot_20260822_193744): an EXPLICIT `/goal start
   // <text>` is user intent. The fragment heuristics (dangling-fragment,
   // lowercase-fragment, …) exist to stop AGENT-authored report garbage from
@@ -1080,7 +1102,7 @@ export function guardGoalBeforeContinuation(
   }
   goal.status = "paused";
   goal.pauseKind = "blocked";
-  goal.pauseReason = `Suspicious objective detected (${assessment.reasons.join(", ")}).`;
+  goal.pauseReason = `${SUSPICIOUS_PAUSE_PREFIX}${assessment.reasons.join(", ")}).`;
   goal.pauseSuggestedAction = `${activeGoalSurfaceCommand("tweak")} the objective if needed; /list next starts the preserved repair/replan task, then resume the original target after its confirmed task list is accepted.`;
   goal.pauseResumeAt = undefined;
   goal.updatedAt = nowIso();
@@ -1099,6 +1121,14 @@ export function scheduleContinuation(ctx: ExtensionContext, force = false, delay
   if (mainModelRecoveryActive()) return;
   if (flags.sessionHandoffPending || flags.initialSessionLoadPending || flags.extensionApiStale || flags.staleTerminalDone || flags.zombieStoodDown) return;
   if (pendingContinuationDispatch) return;
+  // In-flight auto-compaction: never dispatch into a compacting host
+  // (field 083546). force (explicit user intent) still bypasses — the
+  // user is alive and the host answered. The post-compact settle owns
+  // the single bounded resume probe.
+  if (!force && isCompactionInFlightSince(flags.compactionInFlightSince)) {
+    appendLedger(ctx.cwd, "continuation_dispatch_deferred_compaction", { goalId: state.goal?.id ?? null });
+    return;
+  }
   if (continuationDispatchStoodDown && !force) return;
   if (force) releaseContinuationDispatchStandDown();
   if (!isActionableGoal()) return;
@@ -1436,21 +1466,25 @@ export function sendLengthContinue(ctx: ExtensionContext, consecutive: number):
   // chain — same abort-latch reasoning as sendContinuation.
   if (flags.sessionHandoffPending || flags.initialSessionLoadPending || !flags.extensionApi || flags.extensionApiStale || continuationDispatchStoodDown || pendingContinuationDispatch || flags.abortedStandDown) return;
   if (state.goal && !guardGoalBeforeContinuation(ctx, "length-continuation")) return;
+  // v0.38.66 (PR #55, FOF11): active goals get completion-aware recovery
+  // text — a truncated turn must offer closure, not another blind work
+  // pass. Plain sessions keep the generic text.
+  const content = state.goal?.status === "active" ? GOAL_LENGTH_CONTINUE_TEXT : LENGTH_CONTINUE_TEXT;
   const attempt = dispatchPrepare(ctx, {
     generation: flags.sessionGeneration,
     ownerSessionId: sessionManagerId(ctx),
     kind: "length",
-    marker: LENGTH_CONTINUE_TEXT.slice(0, 80),
+    marker: content.slice(0, 80),
     resync: false,
   });
   if (!attempt) return;
   try {
     flags.extensionApi.sendMessage({
       customType: GOAL_EVENT_ENTRY,
-      content: LENGTH_CONTINUE_TEXT,
+      content,
       display: true,
     }, { triggerTurn: true, deliverAs: "followUp" });
-    lastContinuationSentPayload = { content: LENGTH_CONTINUE_TEXT, display: true }; // v0.34.88: verbatim retry payload
+    lastContinuationSentPayload = { content, display: true }; // v0.34.88: verbatim retry payload
     if (!dispatchAccepted(ctx, attempt)) return;
     appendLedger(ctx.cwd, "length_continue_sent", { consecutive, attemptId: attempt.id });
     ctx.ui.notify(`Response hit the output-token cap — auto-continuing (${consecutive}/${LENGTH_CONTINUE_MAX})`, "warning");

package/extensions/goal-heartbeat.ts

@@ -33,6 +33,7 @@ import {
   type Goal,
 } from "./goal-loop-core.js";
 import { loadSettings } from "./goal-settings.js";
+import { isCompactionInFlightSince } from "./main-model-recovery.js";
 import {
   HEARTBEAT_STALL_MS,
   PENDING_LATCH_STUCK_MS,
@@ -67,6 +68,7 @@ export interface HeartbeatFlags {
   get sessionHandoffPending(): boolean;
   set sessionHandoffPending(v: boolean);
   get compactionGraceUntil(): number;
+  get compactionInFlightSince(): number | null;
   get continuationDispatchStoodDown(): boolean;
   get pendingContinuationDispatch(): ContinuationDispatch | null;
   get postCompactResumeOwed(): boolean;
@@ -1317,6 +1319,10 @@ function heartbeatTick(): void {
   // machinery below stays quiet for 3 minutes while the replaced session
   // settles (latch watchdog, wedge alert, refire counting all resume after).
   if (Date.now() < flags.compactionGraceUntil) return;
+  // In-flight auto-compaction is legitimate busy time (field 083546) —
+  // the whole stall/refire/watchdog machinery below stays quiet while
+  // the marker is armed, same as the post-compact grace above.
+  if (isCompactionInFlightSince(flags.compactionInFlightSince)) return;
   // v0.34.24: an accepted dispatch with no start proof owns the watchdog
   // until its bounded timeout. Do not let the generic heartbeat create a
   // second blind send underneath it; explicit resume or a fresh session