pi-goal-list-loop-audit 0.38.67 → 0.38.69

package/CHANGELOG.md

@@ -1,5 +1,66 @@
 # Changelog
 
+## 0.38.69 — About and README refresh (2026-09-20)
+
+- Refined npm about line and README intro: tighter mission control wording, no em dashes.
+- README range wording uses plain "to" (0 to 10, 1 to 10).
+
+### Antigravity auto-continue port (survey 2026-09-19)
+
+- Mid-run interruption budget (`decisionPauseBudget`): decision pauses past
+  budget auto-default to the recommended option and ledger
+  `decision_budget_auto_default` instead of stalling mid-run.
+- Quota sleep-until-reset: quota-class failures with an explicit upstream
+  hint sleep until reset (5h cap; 5s eager first retry preserved); quota
+  waits never park at the 24h horizon; background primary probe re-arms at
+  reset while fallback serves.
+- Completion-claim evidence-density lint: zero path:line tokens AND zero
+  gate rows rides a ledgered NOTE annotation (claim still audits); every
+  terminal path already ends with the archive record pointer.
+- Per-repo pitfall registry: `.pi-glla/pitfalls.md` (absent stays absent)
+  rides the continuation prompt under REPO PITFALLS, ledgered once per goal.
+- Objection-attached retries: every disapproval extracts durable TODOs via
+  `durableObjectionsForDisapproval` (aggressive keeps only cap/no-progress
+  behaviors); two pre-existing source-shape pins revised to the new shape.
+
+## 0.38.68 — Relentless auto-continue: heat-routed exhaustion, quota retries, truthful recovering (2026-09-19)
+
+### Length-exhaustion wedge fixed at the root: heat, not budget (field 162348)
+
+Repeated output-token truncation at near-full context is a heat problem —
+the prompt no longer fits the model — so growing the truncation budget
+only ping-pongs into the same wall. `decideLengthExhaustion` now routes on
+`contextPercent`: roomy context restarts the truncation budget relentlessly
+(episode 1 of a bounded 2-episode budget, episode 2 parks durably),
+near-full context with a larger-context fallback rotates models, and
+near-full context without one yields to pi auto-compaction and lets the
+settle path own the resume. The compact-defer path no longer kicks a fresh
+turn into the known-hot window, and a manual `/goal resume` between
+episodes restarts the cycle instead of parking one round early.
+
+### Quota-identical auditor failures hammer bounded retries (field 150821)
+
+Rate-limit and plan-quota walls are transient, so they are exempt from the
+identical-failure park: the auditor keeps hammering its bounded retry plan
+instead of parking with "check the auditor/model setup". Billing walls
+and non-quota infra failures still park truthfully. A resumed or recovered
+cycle reseeds the dead candidate chain via `freshAuditorCycleClaim`
+instead of re-walking it, and no longer renders the previous cycle's dead
+chain or diagnostic one round late.
+
+### Armed retry renders recovering, not dead-paused (field 151113)
+
+A supervised auditor wait with an armed retry now renders `recovering`
+with an auto-retrying status line. Bare user waits with no pending claim
+still render `paused` — no false recovering labels.
+
+### glla-delegate skill states its drafting precondition (field 125302)
+
+The skill doc now says `propose_goal_draft` only runs inside an already-open
+drafting session (bare `/goal`, `/list`, or `/list add`), refuses from
+normal chat, and falls back to `list_add` — the refusal is correct
+behavior, so this is a doc fix with a regression pin, no prod change.
+
 ## 0.38.67 — Stop clobbering other extensions' compactions (2026-09-19)
 
 ### session_before_compact returns nothing (issue #56, ezoushen)

package/README.md

@@ -4,20 +4,20 @@
   <img src="media/glla2.png" alt="GLLA mission control" width="960">
 </p>
 
-> **Long-running, high-leverage autonomy for pi.**
+> **Long running, high leverage autonomy for pi.**
 >
 > Give pi a meaningful outcome. GLLA helps it research, plan, execute,
 > recover, and prove the result over hours or days instead of treating one
 > chat turn as the whole job.
 
 `pi-goal-list-loop-audit` (GLLA) is mission control for autonomous work in
-[pi](https://github.com/badlogic/pi-mono). It is for the work that is too broad,
+[pi](https://github.com/badlogic/pi-mono). It fits work that is too broad,
 too long, or too important to leave to a single uninterrupted prompt:
 repo-wide changes, migrations, audits, research, documentation overhauls,
 large refactors, and continuous improvement.
 
-GLLA does not promise that an agent can never make a mistake. It makes the
-agent's work **more effective, durable, recoverable, and difficult to declare
+GLLA does not promise that an agent never makes a mistake. It makes the
+agent's work **more effective, durable, recoverable, and hard to declare
 finished without evidence**:
 
 - You state the outcome and what “done” means.
@@ -30,7 +30,7 @@ finished without evidence**:
 - A separate detached auditor checks the saved completion claim before GLLA
   accepts it.
 
-The aim is not “run forever.” The aim is **more useful work per unit of
+The aim is not "run forever." The aim is **more useful work per unit of
 attention, with event-driven progress instead of guessed-duration waiting, and
 better evidence at the end**. See `docs/DESIGN-long-running-supervision.md` for
 the long-running policy.
@@ -398,7 +398,7 @@ proof of a quota or billing state.
 
 - automatic retries are bounded and visible; a BUSY/no-stream turn is parked
   and re-dispatched within the configurable **Zero-stream retries** budget
-  (default 3, range 0–10), then requires explicit resume;
+  (default 3, range 0 to 10), then requires explicit resume;
 - `/goal resume`, `/list resume`, and `/loop resume` are explicit recovery
   paths;
 - a user abort means stop, not “try again behind my back”;
@@ -431,7 +431,7 @@ Open `/glla` for the settings table. The most important choices are:
 - **Subagent hang escalation:** warning-only at `0`, or one child-specific
   action after a confirmed frozen interval;
 - **Zero-stream retries:** automatic GLLA recovery attempts after a busy,
-  stream-silent Pi turn; `0` keeps recovery manual and `1–10` bounds repeats;
+  stream-silent Pi turn; `0` keeps recovery manual and `1 to 10` bounds repeats;
 - **Audit cap and retry cadence:** bounds for repeated objections and
   infrastructure recovery.
 

package/docs/INDEX.md

@@ -16,7 +16,7 @@ Policy contracts and recent changes live in the `audit/` directory of the
   failback; v0.35.9 hardened cross-version npm tarball checks; v0.35.10
   handles multi-entry npm dry-run reports; v0.35.11 accepts both npm report
   shapes; v0.35.12 supports npm 12's keyed pack reports; v0.35.13 fixes stale-API recovery loops.
-  v0.35.14–v0.38.67 continue through the supervisor freeze (`/glla pause`),
+  v0.35.14–v0.38.69 continue through the supervisor freeze (`/glla pause`),
   load hold, auditor picker parity, Windows launch fix, zombie-watchdog
   subagent carve-out, due-wait backstop, the `/glla agents` visibility panel,
   durable state-root selection, blank-until-resume auditor context, frozen

package/docs/SETTINGS.md

@@ -64,6 +64,7 @@ copies are ignored (the recovery runtime reads the global file):
 | `wedgeAlertMinutes` | unset (30, or off while aggressive mode is on — the default) | Busy-but-silent minutes before the wedge alert; `0` = off. The menu shows the effective value. |
 | `autoResume` | `false` | Restored goals/loops/lists auto-resume in fresh sessions. Global-only. |
 | `decisionPopup` | `true` | Decision pauses pop the picker (`false` = widget card only). |
+| `decisionPauseBudget` | unset (unlimited) | Max agent-authored decision pauses per goal before auto-default: the (N+1)-th adopts the recommended option as a logged assumption without pausing. `0` = relentless from the first decision. |
 | `carryover` | `"pause"` | Stale carryover on new activation: `"pause"` / `"clear"` / `"resume"`. |
 | `autoAcceptDrafts` | `false` | Drafts activate without the Confirm dialog (unattended rigs). |
 | `auditCap` | `5` (10 aggressive) | Pause after N consecutive auditor disapprovals (`0` = unlimited). |

package/extensions/completion-summary.ts

@@ -1,5 +1,5 @@
 import { execFileSync } from "node:child_process";
-import type { FindingGroup, GateRow, Goal, Status } from "./goal-loop-core.js";
+import { sanitizeDisplayText, type FindingGroup, type GateRow, type Goal, type Status } from "./goal-loop-core.js";
 import { fmtElapsed, truncateCells } from "./goal-loop-display.js";
 
 /**
@@ -180,9 +180,10 @@ export interface HumanCompletionBrief {
  * the durable archive keeps the full text. Falls back to the original
  * when stripping would empty the value. */
 export function chatSafeDetailValue(value: string): string {
+  const safeValue = sanitizeDisplayText(value);
   // v0.38.45 audit: loop the innermost-group strip to a fixpoint
   // (bounded) — a single pass left nested husks like "(log )" behind.
-  let withoutGroups = stripMachineGroups(value);
+  let withoutGroups = stripMachineGroups(safeValue);
   const stripped = withoutGroups
     .replace(/(?:\/var)?\/tmp\/\S+/g, "")
     .replace(/\btarballs?\s+\S+\.tgz\b/gi, "")
@@ -190,7 +191,7 @@ export function chatSafeDetailValue(value: string): string {
     .replace(/\(\s*\)/g, "")
     .replace(/\s{2,}/g, " ")
     .trim();
-  return stripped || value;
+  return stripped || safeValue;
 }
 
 /** The human briefing: outcome first in its own words, then only the
@@ -384,7 +385,7 @@ function stripMachineTokens(line: string): string {
 export function structuredSummaryLines(summary: string | undefined, label = "Outcome:"): string[] | null {
   const raw = rawLabelValue(summary ?? "", label);
   if (!raw || !isSectionStructured(raw)) return null;
-  const lines = raw.split("\n").map(stripMachineTokens);
+  const lines = raw.split("\n").map((line) => stripMachineTokens(sanitizeDisplayText(line)));
   while (lines.length > 0 && !(lines[0] ?? "").trim()) lines.shift();
   while (lines.length > 0 && !(lines[lines.length - 1] ?? "").trim()) lines.pop();
   let text = lines.join("\n");
@@ -416,7 +417,7 @@ export interface RichTerminalParts {
 }
 
 function escapeTableCell(value: string): string {
-  return value.replace(/\|/g, "\\|").replace(/\s+/g, " ").trim();
+  return sanitizeDisplayText(value).replace(/\|/g, "\\|").replace(/\s+/g, " ").trim();
 }
 
 function testsRowStatus(value: string): string {
@@ -470,9 +471,10 @@ function auditRowStatus(history: Goal["auditHistory"]): string {
 
 /** Split a stale-filtered `Label: value` detail into a bold lead + body. */
 function leadBody(detail: string): { lead: string; body: string } {
-  const separator = detail.indexOf(":");
-  if (separator < 0) return { lead: "Note", body: detail };
-  return { lead: detail.slice(0, separator).trim() || "Note", body: detail.slice(separator + 1).trim() };
+  const safeDetail = sanitizeDisplayText(detail);
+  const separator = safeDetail.indexOf(":");
+  if (separator < 0) return { lead: "Note", body: safeDetail };
+  return { lead: safeDetail.slice(0, separator).trim() || "Note", body: safeDetail.slice(separator + 1).trim() };
 }
 
 /**
@@ -487,7 +489,7 @@ const EVIDENCE_TOKEN_PATTERN = /(?<![/~+\w])[\w.+][\w.+/-]*\.[A-Za-z0-9]{1,8}:\d
 
 export function extractEvidenceTokens(text: string): { text: string; evidence: string[] } {
   const evidence: string[] = [];
-  const stripped = text
+  const stripped = sanitizeDisplayText(text)
     .replace(EVIDENCE_TOKEN_PATTERN, (match) => {
       if (evidence.length < RICH_EVIDENCE_TOKENS_PER_FINDING && !evidence.includes(match)) evidence.push(match);
       // The token often rides in parentheses — move the wrapper too, so
@@ -501,6 +503,29 @@ export function extractEvidenceTokens(text: string): { text: string; evidence: s
   return { text: stripped, evidence };
 }
 
+/**
+ * v0.38.69 (Antigravity port): completion-claim evidence-density lint.
+ * A walkthrough always ships areas + counts; GLLA richness rode optional
+ * agent params, so a flat six-label claim with zero path:line tokens and
+ * zero gate rows still passed. Returns a NOTE annotation when the claim
+ * carries no verifiable pointer at all (no evidence tokens across the
+ * summary and every group finding, and no gate rows) — the claim still
+ * audits, but the terminal render falls back to recorded facts. Tokens in
+ * finding groups count; gate rows count as density without tokens.
+ */
+export function completionSummaryDensityNote(
+  summary: string | undefined,
+  groups?: FindingGroup[],
+  gates?: GateRow[],
+): string | undefined {
+  if (!summary?.trim()) return undefined;
+  const pool = [summary, ...(groups ?? []).flatMap((group) => group.findings ?? [])].join("\n");
+  const { evidence } = extractEvidenceTokens(pool);
+  if (evidence.length > 0) return undefined;
+  if ((gates ?? []).length > 0) return undefined;
+  return "low evidence density: no path:line evidence tokens and no verification gate rows — add file:line pointers (e.g. extensions/goal-recovery.ts:847) or a gateRows inventory so the terminal render is verifiable";
+}
+
 /**
  * v0.38.50: one compact duration line from durable goal state — turns,
  * wall-clock elapsed since creation, and audit count. Only known facts
@@ -509,7 +534,9 @@ export function extractEvidenceTokens(text: string): { text: string; evidence: s
 export function buildDurationLine(goal: Goal, now = Date.now()): string | null {
   const segs: string[] = [];
   const turns = goal.telemetry?.turns;
-  if (typeof turns === "number" && Number.isFinite(turns) && turns >= 0) {
+  // Field 20260918_172705: a zero turns count means untracked telemetry,
+  // not a known fact — omit it while elapsed/audits still render.
+  if (typeof turns === "number" && Number.isFinite(turns) && turns > 0) {
     segs.push(`${turns} turn${turns === 1 ? "" : "s"}`);
   }
   const started = Date.parse(goal.createdAt ?? "");
@@ -519,15 +546,25 @@ export function buildDurationLine(goal: Goal, now = Date.now()): string | null {
   return segs.length > 0 ? `\u2014 ${segs.join(" \u00b7 ")}` : null;
 }
 
-/** Partition informing details into findings / Tests / next buckets. */
+/** Partition informing details into findings / Tests / next buckets.
+ * Field 20260918_172705: exact-duplicate lines collapse to one per bucket
+ * (repeated claim details rendered as doubled rows). Near-duplicates with
+ * different wording still render — that prose belongs to the claim. */
 export function partitionRichDetails(details: string[]): { findings: string[]; tests: string[]; next: string[] } {
+  const seen = new Set<string>();
+  const push = (bucket: string[], detail: string) => {
+    const key = detail.trim();
+    if (seen.has(key)) return;
+    seen.add(key);
+    bucket.push(detail);
+  };
   const findings: string[] = [];
   const tests: string[] = [];
   const next: string[] = [];
   for (const detail of details) {
-    if (/^\s*Tests\s*:/i.test(detail)) tests.push(detail);
-    else if (/^\s*(Next|Unresolved|Left out)\s*:/i.test(detail)) next.push(detail);
-    else findings.push(detail);
+    if (/^\s*Tests\s*:/i.test(detail)) push(tests, detail);
+    else if (/^\s*(Next|Unresolved|Left out)\s*:/i.test(detail)) push(next, detail);
+    else push(findings, detail);
   }
   return { findings, tests, next };
 }
@@ -538,15 +575,17 @@ export function partitionRichDetails(details: string[]): { findings: string[]; t
  * `## Done — outcome` shape stays, so direct unit callers are unaffected.
  */
 export function requestEchoHeadline(kind: "Done" | "Aborted", objective: string | undefined, outcome: string): string {
-  const echo = objective?.trim() ? clipSummaryValue(objective.trim(), RICH_OBJECTIVE_ECHO_CHARS) : null;
-  return echo ? `## ${kind}: ${echo} \u2014 ${outcome}` : `## ${kind} \u2014 ${outcome}`;
+  const safeObjective = objective ? sanitizeDisplayText(objective) : "";
+  const safeOutcome = sanitizeDisplayText(outcome);
+  const echo = safeObjective.trim() ? clipSummaryValue(safeObjective.trim(), RICH_OBJECTIVE_ECHO_CHARS) : null;
+  return echo ? `## ${kind}: ${echo} \u2014 ${safeOutcome}` : `## ${kind} \u2014 ${safeOutcome}`;
 }
 
 /** Chat-only projection: keep explanations and counts, not command/hash receipts.
  * Repository-only findings are filtered separately; useful implementation
  * references in substantive explanations are not themselves bookkeeping. */
 function chatNarrative(value: string): string {
-  return stripMachineGroups(chatSafeDetailValue(value)
+  return stripMachineGroups(chatSafeDetailValue(sanitizeDisplayText(value))
     .replace(/\b(?:fixed in|commit|HEAD(?: at)?|built from)\s+`?[a-f0-9]{7,64}`?/gi, "")
     .replace(/\b(?=[a-f0-9]*[a-f])(?=[a-f0-9]*\d)[a-f0-9]{7,64}\b/gi, "")
     .replace(/`(?:bun|npm|npx|node|git|tsc)\s+[^`]+`/g, "")
@@ -620,9 +659,12 @@ export function buildFinalRepoStateLines(cwd: string): string[] | undefined {
       return undefined;
     }
   };
-  const branch = run(["branch", "--show-current"]);
-  const head = run(["log", "-1", "--format=%h %s"]);
-  const short = run(["status", "--short"]);
+  const branchRaw = run(["branch", "--show-current"]);
+  const headRaw = run(["log", "-1", "--format=%h %s"]);
+  const shortRaw = run(["status", "--short"]);
+  const branch = branchRaw === undefined ? undefined : sanitizeDisplayText(branchRaw);
+  const head = headRaw === undefined ? undefined : sanitizeDisplayText(headRaw);
+  const short = shortRaw === undefined ? undefined : shortRaw.split("\n").map((line) => sanitizeDisplayText(line)).join("\n");
   if (!branch && !head && short === undefined) return undefined;
   const lines = [`Branch ${branch ?? "detached"}${head ? ` @ ${head}` : ""}`];
   if (short === undefined) lines.push("Tree state unreadable");
@@ -660,7 +702,7 @@ export function buildRichTerminalParts(args: {
   chat?: boolean;
 }): RichTerminalParts {
   const { findings, tests, next } = partitionRichDetails(args.details);
-  const outcome = args.outcome;
+  const outcome = sanitizeDisplayText(args.outcome);
   const kind = args.kind ?? "Done";
   const headline = args.chat ? `## ${kind} — ${outcome}` : requestEchoHeadline(kind, args.objective, outcome);
   const auditStatus = auditRowStatus(args.auditHistory);
@@ -676,11 +718,11 @@ export function buildRichTerminalParts(args: {
     findingLines.push("| Area | Finding | Evidence |", "| --- | --- | --- |");
     for (const group of groups) {
       group.findings.forEach((finding, fi) => {
-        const { text, evidence } = extractEvidenceTokens(finding);
+        const { text, evidence } = extractEvidenceTokens(sanitizeDisplayText(finding));
         const { lead, body } = leadBody(text);
         // v0.38.52: test proof rides the Evidence cell (tables have no
         // sub-bullets); cells stay pipe-escaped. v0.38.55: unclipped.
-        const proof = group.tests?.[fi]?.trim();
+        const proof = group.tests?.[fi] ? sanitizeDisplayText(group.tests[fi]).trim() : "";
         const evidenceCell = [evidence.join(", ") || "\u2014", ...(proof ? [`Tests: ${proof}`] : [])].join(" \u00b7 ");
         findingLines.push(
           `| ${escapeTableCell(group.title)} | ${escapeTableCell(`**${lead}** \u2014 ${body}`)} | ${escapeTableCell(evidenceCell)} |`,
@@ -689,12 +731,12 @@ export function buildRichTerminalParts(args: {
     }
   } else if (groups.length > 0) {
     groups.forEach((group, i) => {
-      findingLines.push(`#### ${i + 1}. ${group.title}`);
+      findingLines.push(`#### ${i + 1}. ${sanitizeDisplayText(group.title)}`);
       group.findings.forEach((finding, fi) => {
-        const { lead, body } = leadBody(args.chat ? chatNarrative(extractEvidenceTokens(finding).text) : finding);
+        const { lead, body } = leadBody(args.chat ? chatNarrative(extractEvidenceTokens(finding).text) : sanitizeDisplayText(finding));
         findingLines.push(`- **${lead}** \u2014 ${body}`);
         // v0.38.52: per-finding test proof (shot C) — absent stays absent.
-        const proof = group.tests?.[fi]?.trim();
+        const proof = group.tests?.[fi] ? sanitizeDisplayText(group.tests[fi]).trim() : "";
         if (proof) findingLines.push(`  - Test Results: ${args.chat ? chatNarrative(proof) : proof}`);
       });
     });
@@ -716,22 +758,25 @@ export function buildRichTerminalParts(args: {
   const showCommand = !args.chat && gates.some((row) => row.command?.trim());
   if (gates.length > 0) {
     for (const row of gates) {
-      const derived = testsRowStatus(row.notes ?? "");
-      const notes = args.chat ? chatNarrative(row.notes ?? "") : row.notes?.trim();
-      const command = row.command?.trim() || "\u2014";
+      const safeNotes = row.notes ? sanitizeDisplayText(row.notes).trim() : "";
+      const derived = testsRowStatus(safeNotes);
+      const notes = args.chat ? chatNarrative(safeNotes) : safeNotes;
+      const command = row.command ? sanitizeDisplayText(row.command).trim() : "\u2014";
+      const gate = sanitizeDisplayText(row.gate);
+      const scope = row.scope ? sanitizeDisplayText(row.scope).trim() : "\u2014";
       tableRows.push(showCommand
-        ? `| ${escapeTableCell(row.gate)} | ${escapeTableCell(command)} | ${escapeTableCell(row.scope?.trim() || "\u2014")} | ${derived} | ${escapeTableCell(notes || "\u2014")} |`
-        : `| ${escapeTableCell(row.gate)} | ${escapeTableCell(row.scope?.trim() || "\u2014")} | ${derived} | ${escapeTableCell(notes || "\u2014")} |`);
+        ? `| ${escapeTableCell(gate)} | ${escapeTableCell(command)} | ${escapeTableCell(scope)} | ${derived} | ${escapeTableCell(notes || "\u2014")} |`
+        : `| ${escapeTableCell(gate)} | ${escapeTableCell(scope)} | ${derived} | ${escapeTableCell(notes || "\u2014")} |`);
     }
   } else {
     for (const detail of tests) {
       const { body } = leadBody(detail);
       const status = testsRowStatus(body);
-      tableRows.push(`| Tests | ${status} | ${escapeTableCell(args.chat ? chatNarrative(body) : body)} |`);
+      tableRows.push(`| Tests | ${status} | ${escapeTableCell(args.chat ? chatNarrative(body) : sanitizeDisplayText(body))} |`);
     }
   }
   if (!args.chat && auditStatus !== "NO VERDICT") {
-    const auditBody = args.countsLine.replace(/^\u2014\s*/, "").replace(/\.\s*$/, "");
+    const auditBody = sanitizeDisplayText(args.countsLine).replace(/^\u2014\s*/, "").replace(/\.\s*$/, "");
     // v0.38.55 audit: the Audit row's Scope names the row kind — the old
     // shape duplicated the counts text in Scope and Notes.
     if (gates.length > 0) {
@@ -763,8 +808,8 @@ export function buildRichTerminalParts(args: {
     findingLines,
     tableLines,
     nextLines,
-    repoLines: args.chat ? [] : args.repoState ?? [],
-    summaryLines: args.summaryLines ?? [],
+    repoLines: args.chat ? [] : (args.repoState ?? []).map((line) => sanitizeDisplayText(line)),
+    summaryLines: (args.summaryLines ?? []).map((line) => sanitizeDisplayText(line)),
   };
 }
 
@@ -776,28 +821,30 @@ export function buildRichTerminalParts(args: {
  * final repository state closes it — findings, verification, Next,
  * repo state, in that order. */
 export function composeRichTerminalLines(parts: RichTerminalParts): string[] {
-  const lines = [parts.banner ?? parts.headline, ""];
-  if (parts.headline !== lines[0]) lines.push(parts.headline, "");
-  if (parts.durationLine) lines.push(parts.durationLine, "");
+  const banner = sanitizeDisplayText(parts.banner ?? parts.headline);
+  const headline = sanitizeDisplayText(parts.headline);
+  const lines = [banner, ""];
+  if (headline !== lines[0]) lines.push(headline, "");
+  if (parts.durationLine) lines.push(sanitizeDisplayText(parts.durationLine), "");
   // Structured-long (field 2026-09-16): the full Outcome body rides its
   // own section between the headline and the findings — findings-first
   // order is preserved (findings, verification, Next keep their relative
   // order), the headline echo stays short, and the one-action Next rule
   // is untouched.
   if (parts.summaryLines.length > 0) {
-    lines.push("### Summary", ...parts.summaryLines, "");
+    lines.push("### Summary", ...parts.summaryLines.map((line) => sanitizeDisplayText(line)), "");
   }
   if (parts.findingLines.length > 0) {
-    lines.push("### Key Findings & Remediation", ...parts.findingLines, "");
+    lines.push("### Key Findings & Remediation", ...parts.findingLines.map((line) => sanitizeDisplayText(line)), "");
   }
   if (parts.tableLines.length > 0) {
-    lines.push("### Verification Summary", ...parts.tableLines, "");
+    lines.push("### Verification Summary", ...parts.tableLines.map((line) => sanitizeDisplayText(line)), "");
   }
   if (parts.nextLines.length > 0) {
-    lines.push("### Next", ...parts.nextLines, "");
+    lines.push("### Next", ...parts.nextLines.map((line) => sanitizeDisplayText(line)), "");
   }
   if (parts.repoLines.length > 0) {
-    lines.push("### Final Repository State", ...parts.repoLines.map((line) => `- ${line}`), "");
+    lines.push("### Final Repository State", ...parts.repoLines.map((line) => `- ${sanitizeDisplayText(line)}`), "");
   }
   return lines;
 }
@@ -889,7 +936,7 @@ function stripApprovalModel(line: string): string {
   return line.replace(/auditor\s+\S+\s+approved/, "auditor approved");
 }
 function trailerBullet(line: string): string {
-  return `• ${line.replace(/^—\s*/, "")}`;
+  return `• ${sanitizeDisplayText(line).replace(/^—\s*/, "")}`;
 }
 
 /** v0.38.25: the audit-goal counts line — verdict proof ONLY, built from

package/extensions/goal-commands.ts

@@ -113,7 +113,7 @@ export interface CommandDeps {
   releaseContinuationDispatchStandDown: () => void;
   releaseInitialSessionLoadBarrier: () => void;
   resolveCarryover: (ctx: ExtensionContext, trigger: "goal" | "loop" | "list") => boolean;
-  safeSteerUser: (ctx: ExtensionContext, text: string) => boolean;
+  resetLengthExhaustionEpisodes: () => void;  safeSteerUser: (ctx: ExtensionContext, text: string) => boolean;
   scheduleContinuation: (ctx: ExtensionContext, force?: boolean, delayMs?: number) => void;
   scheduleSessionTimeout: (callback: () => void, delayMs: number) => NodeJS.Timeout;
   createGoal: (objective: string, ctx: ExtensionContext, policy?: "goal" | "list") => Goal;
@@ -138,7 +138,7 @@ let listQueue: CommandDeps["listQueue"], notifyExternal: CommandDeps["notifyExte
     archiveCurrentGoal: CommandDeps["archiveCurrentGoal"], healGoalPolicy: CommandDeps["healGoalPolicy"], startDrafting: CommandDeps["startDrafting"], warnIfStaleAtEntry: CommandDeps["warnIfStaleAtEntry"], queuePendingListOperation: CommandDeps["queuePendingListOperation"], freshCtx: CommandDeps["freshCtx"],
     freshCtxForGeneration: CommandDeps["freshCtxForGeneration"], goStaleTerminal: CommandDeps["goStaleTerminal"], groupOpenChildren: CommandDeps["groupOpenChildren"], activateNextListItem: CommandDeps["activateNextListItem"], clearMainModelRecoveryTimer: CommandDeps["clearMainModelRecoveryTimer"], mainModelRecoveryTimerActive: CommandDeps["mainModelRecoveryTimerActive"], continuationDispatchPending: CommandDeps["continuationDispatchPending"], resetContinuationDispatchState: CommandDeps["resetContinuationDispatchState"],
     isCompletionAuditRecoveryPending: CommandDeps["isCompletionAuditRecoveryPending"], markCompletionAuditRecoveryPending: CommandDeps["markCompletionAuditRecoveryPending"], retryStoredCompletionAudit: CommandDeps["retryStoredCompletionAudit"], probeMainModelRecovery: CommandDeps["probeMainModelRecovery"], releaseContinuationDispatchStandDown: CommandDeps["releaseContinuationDispatchStandDown"],
-    releaseInitialSessionLoadBarrier: CommandDeps["releaseInitialSessionLoadBarrier"], resolveCarryover: CommandDeps["resolveCarryover"], safeSteerUser: CommandDeps["safeSteerUser"], scheduleContinuation: CommandDeps["scheduleContinuation"], scheduleSessionTimeout: CommandDeps["scheduleSessionTimeout"],
+    releaseInitialSessionLoadBarrier: CommandDeps["releaseInitialSessionLoadBarrier"], resolveCarryover: CommandDeps["resolveCarryover"], resetLengthExhaustionEpisodes: CommandDeps["resetLengthExhaustionEpisodes"], safeSteerUser: CommandDeps["safeSteerUser"], scheduleContinuation: CommandDeps["scheduleContinuation"], scheduleSessionTimeout: CommandDeps["scheduleSessionTimeout"],
     createGoal: CommandDeps["createGoal"], fireReviewer: CommandDeps["fireReviewer"], openSettingsUI: CommandDeps["openSettingsUI"], manuallyResumeMainModelRecovery: CommandDeps["manuallyResumeMainModelRecovery"], activeGoalCommand: CommandDeps["activeGoalCommand"],
     activeGoalStatusCommand: CommandDeps["activeGoalStatusCommand"], activeGoalSurfaceCommand: CommandDeps["activeGoalSurfaceCommand"], goalNoun: CommandDeps["goalNoun"], displaySlice: CommandDeps["displaySlice"], shortObj: CommandDeps["shortObj"];
 
@@ -148,7 +148,7 @@ export function createGoalCommands(d: CommandDeps): void {
   archiveCurrentGoal = d.archiveCurrentGoal; healGoalPolicy = d.healGoalPolicy; startDrafting = d.startDrafting; warnIfStaleAtEntry = d.warnIfStaleAtEntry; queuePendingListOperation = d.queuePendingListOperation; freshCtx = d.freshCtx;
   freshCtxForGeneration = d.freshCtxForGeneration; goStaleTerminal = d.goStaleTerminal; groupOpenChildren = d.groupOpenChildren; activateNextListItem = d.activateNextListItem; clearMainModelRecoveryTimer = d.clearMainModelRecoveryTimer; mainModelRecoveryTimerActive = d.mainModelRecoveryTimerActive; continuationDispatchPending = d.continuationDispatchPending; resetContinuationDispatchState = d.resetContinuationDispatchState;
   isCompletionAuditRecoveryPending = d.isCompletionAuditRecoveryPending; markCompletionAuditRecoveryPending = d.markCompletionAuditRecoveryPending; retryStoredCompletionAudit = d.retryStoredCompletionAudit; probeMainModelRecovery = d.probeMainModelRecovery; releaseContinuationDispatchStandDown = d.releaseContinuationDispatchStandDown;
-  releaseInitialSessionLoadBarrier = d.releaseInitialSessionLoadBarrier; resolveCarryover = d.resolveCarryover; safeSteerUser = d.safeSteerUser; scheduleContinuation = d.scheduleContinuation; scheduleSessionTimeout = d.scheduleSessionTimeout;
+  releaseInitialSessionLoadBarrier = d.releaseInitialSessionLoadBarrier; resolveCarryover = d.resolveCarryover; resetLengthExhaustionEpisodes = d.resetLengthExhaustionEpisodes; safeSteerUser = d.safeSteerUser; scheduleContinuation = d.scheduleContinuation; scheduleSessionTimeout = d.scheduleSessionTimeout;
   createGoal = d.createGoal; fireReviewer = d.fireReviewer; openSettingsUI = d.openSettingsUI; manuallyResumeMainModelRecovery = d.manuallyResumeMainModelRecovery; activeGoalCommand = d.activeGoalCommand;
   activeGoalStatusCommand = d.activeGoalStatusCommand; activeGoalSurfaceCommand = d.activeGoalSurfaceCommand; goalNoun = d.goalNoun; displaySlice = d.displaySlice; shortObj = d.shortObj;
   agentsSnapshot = d.agentsSnapshot;
@@ -589,6 +589,10 @@ async function cmdResume(ctx: ExtensionContext): Promise<void> {
   updateGoal({ status: "active", pauseReason: undefined, pauseSuggestedAction: undefined, pauseKind: undefined, pauseOptions: undefined, pauseRecommended: undefined, pauseResumeAt: undefined, interruptedAt: undefined, interruptedReason: undefined, autoResumedAt: undefined, autoResumedEvent: undefined, ...(staleEntry ? { interruptedAt: nowIso(), interruptedReason: "resumed in a stale session" } : {}), ...(usage ? { usage } : {}) }, ctx);
   if (staleEntry) return;
   releaseAuditorSurface();
+  // A manual resume starts a fresh relentless cycle: a user pause between
+  // an episode-1 exhaustion wedge and the next one must not make that
+  // wedge park one cycle early.
+  resetLengthExhaustionEpisodes();
   // A stored completion claim is a direct-audit resume, not an agent turn.
   // Keeping the claim while merely scheduling a continuation left manual
   // pause/resume with an ACTIVE goal that no timer would ever consume.

package/extensions/goal-continuation.ts

@@ -1420,7 +1420,7 @@ export function sendStallEscalation(ctx: ExtensionContext, nudges: number): void
   if (supervisorPaused(state)) return;
   // Audit 2026-09-07 (HIGH): a stall nudge must not resurrect a stood-down
   // chain — same abort-latch reasoning as sendContinuation.
-  if (flags.sessionHandoffPending || flags.initialSessionLoadPending || !flags.extensionApi || flags.extensionApiStale || continuationDispatchStoodDown || pendingContinuationDispatch || flags.abortedStandDown) return;
+  if (flags.sessionHandoffPending || flags.initialSessionLoadPending || !flags.extensionApi || flags.extensionApiStale || flags.staleTerminalDone || flags.zombieStoodDown || continuationDispatchStoodDown || pendingContinuationDispatch || flags.abortedStandDown) return;
   if (!state.goal || !guardGoalBeforeContinuation(ctx, "stall-escalation")) return;
   const remaining = HEARTBEAT_MAX_NUDGES - nudges;
   const text = [
@@ -1464,7 +1464,7 @@ export function sendLengthContinue(ctx: ExtensionContext, consecutive: number):
   if (supervisorPaused(state)) return;
   // Audit 2026-09-07 (HIGH): a length nudge must not resurrect a stood-down
   // chain — same abort-latch reasoning as sendContinuation.
-  if (flags.sessionHandoffPending || flags.initialSessionLoadPending || !flags.extensionApi || flags.extensionApiStale || continuationDispatchStoodDown || pendingContinuationDispatch || flags.abortedStandDown) return;
+  if (flags.sessionHandoffPending || flags.initialSessionLoadPending || !flags.extensionApi || flags.extensionApiStale || flags.staleTerminalDone || flags.zombieStoodDown || continuationDispatchStoodDown || pendingContinuationDispatch || flags.abortedStandDown) return;
   if (state.goal && !guardGoalBeforeContinuation(ctx, "length-continuation")) return;
   // v0.38.66 (PR #55, FOF11): active goals get completion-aware recovery
   // text — a truncated turn must offer closure, not another blind work
@@ -1525,7 +1525,34 @@ export function buildPostCompactResync(briefExcerpt?: string): string {
   return lines.join("\n") + "\n\n";
 }
 
-export function continuationPrompt(goal: Goal, opts: { includeRestartDetail?: boolean } = {}): string {
+/**
+ * v0.38.69 (Antigravity port, 09-04 borrow candidate #1): per-repo pitfall
+ * registry. `.pi-glla/pitfalls.md` holds distilled, answer-agnostic rakes
+ * (never ledger prose — the ledger is forensics, never distilled). Read at
+ * goal start (and re-read when edited mid-goal); absent/blank/unreadable
+ * resolves absent so repos without one render byte-identical prompts.
+ */
+export const PITFALLS_BRIEF_MAX_CHARS = 1500;
+
+export function readPitfallsBrief(cwd: string): string | undefined {
+  let body: string;
+  try {
+    body = fs.readFileSync(path.join(cwd, ".pi-glla", "pitfalls.md"), "utf8");
+  } catch {
+    return undefined;
+  }
+  const trimmed = body.trim();
+  if (!trimmed) return undefined;
+  return trimmed.length > PITFALLS_BRIEF_MAX_CHARS
+    ? trimmed.slice(0, PITFALLS_BRIEF_MAX_CHARS)
+    : trimmed;
+}
+
+/** Goals already ledgered for their pitfalls consult this process — the
+ * ledger records the consult once per goal, never once per turn. */
+const pitfallsLedgeredGoals = new Set<string>();
+
+export function continuationPrompt(goal: Goal, opts: { includeRestartDetail?: boolean; pitfallsBrief?: string } = {}): string {
   // Read the .md file as the template, then substitute {{tokens}}.
   // For v0.1.0 we inline-substitute so we don't need fs at runtime.
   const next = findNextPendingTask(goal.taskList?.tasks ?? []);
@@ -1583,6 +1610,20 @@ export function continuationPrompt(goal: Goal, opts: { includeRestartDetail?: bo
   if (loadSettings(settingsCwd).visionAssist !== false) {
     directives.push(VISION_ASSIST_GUIDANCE);
   }
+  // v0.38.69 (Antigravity port): the repo pitfall registry rides the
+  // continuation prompt — consulted at goal start, re-read when edited.
+  // Explicit opts win (tests); otherwise the repo file resolves, absent
+  // keeping the prompt byte-identical for repos without one.
+  const pitfallsBrief = opts.pitfallsBrief ?? readPitfallsBrief(settingsCwd);
+  if (pitfallsBrief?.trim()) {
+    directives.push(
+      `## REPO PITFALLS (distilled — consult before acting)\n\nThese rakes already caught this repo. Check your plan against them before the first tool call and before every risky step:\n\n${pitfallsBrief.trim()}`,
+    );
+    if (!pitfallsLedgeredGoals.has(goal.id)) {
+      pitfallsLedgeredGoals.add(goal.id);
+      appendLedger(settingsCwd, "pitfalls_consulted", { goalId: goal.id });
+    }
+  }
   if (effSettings.aggressiveMode && isFullAuditObjective(goal.objective)) {
     directives.push(
       "## FULL-AUDIT MODE (aggressiveMode + survey objective)\n\nThis objective is a survey, not a single fix. Spawn 3+ `scout` subagents NOW — one per subsystem, in a single message so they run in parallel — synthesize their findings, and call `propose_task_list` with the result. Do not start fixing before the task list exists.",