pi-goal-list-loop-audit 0.38.68 → 0.38.69

package/CHANGELOG.md

@@ -1,5 +1,28 @@
 # Changelog
 
+## 0.38.69 — About and README refresh (2026-09-20)
+
+- Refined npm about line and README intro: tighter mission control wording, no em dashes.
+- README range wording uses plain "to" (0 to 10, 1 to 10).
+
+### Antigravity auto-continue port (survey 2026-09-19)
+
+- Mid-run interruption budget (`decisionPauseBudget`): decision pauses past
+  budget auto-default to the recommended option and ledger
+  `decision_budget_auto_default` instead of stalling mid-run.
+- Quota sleep-until-reset: quota-class failures with an explicit upstream
+  hint sleep until reset (5h cap; 5s eager first retry preserved); quota
+  waits never park at the 24h horizon; background primary probe re-arms at
+  reset while fallback serves.
+- Completion-claim evidence-density lint: zero path:line tokens AND zero
+  gate rows rides a ledgered NOTE annotation (claim still audits); every
+  terminal path already ends with the archive record pointer.
+- Per-repo pitfall registry: `.pi-glla/pitfalls.md` (absent stays absent)
+  rides the continuation prompt under REPO PITFALLS, ledgered once per goal.
+- Objection-attached retries: every disapproval extracts durable TODOs via
+  `durableObjectionsForDisapproval` (aggressive keeps only cap/no-progress
+  behaviors); two pre-existing source-shape pins revised to the new shape.
+
 ## 0.38.68 — Relentless auto-continue: heat-routed exhaustion, quota retries, truthful recovering (2026-09-19)
 
 ### Length-exhaustion wedge fixed at the root: heat, not budget (field 162348)

package/README.md

@@ -4,20 +4,20 @@
   <img src="media/glla2.png" alt="GLLA mission control" width="960">
 </p>
 
-> **Long-running, high-leverage autonomy for pi.**
+> **Long running, high leverage autonomy for pi.**
 >
 > Give pi a meaningful outcome. GLLA helps it research, plan, execute,
 > recover, and prove the result over hours or days instead of treating one
 > chat turn as the whole job.
 
 `pi-goal-list-loop-audit` (GLLA) is mission control for autonomous work in
-[pi](https://github.com/badlogic/pi-mono). It is for the work that is too broad,
+[pi](https://github.com/badlogic/pi-mono). It fits work that is too broad,
 too long, or too important to leave to a single uninterrupted prompt:
 repo-wide changes, migrations, audits, research, documentation overhauls,
 large refactors, and continuous improvement.
 
-GLLA does not promise that an agent can never make a mistake. It makes the
-agent's work **more effective, durable, recoverable, and difficult to declare
+GLLA does not promise that an agent never makes a mistake. It makes the
+agent's work **more effective, durable, recoverable, and hard to declare
 finished without evidence**:
 
 - You state the outcome and what “done” means.
@@ -30,7 +30,7 @@ finished without evidence**:
 - A separate detached auditor checks the saved completion claim before GLLA
   accepts it.
 
-The aim is not “run forever.” The aim is **more useful work per unit of
+The aim is not "run forever." The aim is **more useful work per unit of
 attention, with event-driven progress instead of guessed-duration waiting, and
 better evidence at the end**. See `docs/DESIGN-long-running-supervision.md` for
 the long-running policy.
@@ -398,7 +398,7 @@ proof of a quota or billing state.
 
 - automatic retries are bounded and visible; a BUSY/no-stream turn is parked
   and re-dispatched within the configurable **Zero-stream retries** budget
-  (default 3, range 0–10), then requires explicit resume;
+  (default 3, range 0 to 10), then requires explicit resume;
 - `/goal resume`, `/list resume`, and `/loop resume` are explicit recovery
   paths;
 - a user abort means stop, not “try again behind my back”;
@@ -431,7 +431,7 @@ Open `/glla` for the settings table. The most important choices are:
 - **Subagent hang escalation:** warning-only at `0`, or one child-specific
   action after a confirmed frozen interval;
 - **Zero-stream retries:** automatic GLLA recovery attempts after a busy,
-  stream-silent Pi turn; `0` keeps recovery manual and `1–10` bounds repeats;
+  stream-silent Pi turn; `0` keeps recovery manual and `1 to 10` bounds repeats;
 - **Audit cap and retry cadence:** bounds for repeated objections and
   infrastructure recovery.
 

package/docs/INDEX.md

@@ -16,7 +16,7 @@ Policy contracts and recent changes live in the `audit/` directory of the
   failback; v0.35.9 hardened cross-version npm tarball checks; v0.35.10
   handles multi-entry npm dry-run reports; v0.35.11 accepts both npm report
   shapes; v0.35.12 supports npm 12's keyed pack reports; v0.35.13 fixes stale-API recovery loops.
-  v0.35.14–v0.38.68 continue through the supervisor freeze (`/glla pause`),
+  v0.35.14–v0.38.69 continue through the supervisor freeze (`/glla pause`),
   load hold, auditor picker parity, Windows launch fix, zombie-watchdog
   subagent carve-out, due-wait backstop, the `/glla agents` visibility panel,
   durable state-root selection, blank-until-resume auditor context, frozen

package/docs/SETTINGS.md

@@ -64,6 +64,7 @@ copies are ignored (the recovery runtime reads the global file):
 | `wedgeAlertMinutes` | unset (30, or off while aggressive mode is on — the default) | Busy-but-silent minutes before the wedge alert; `0` = off. The menu shows the effective value. |
 | `autoResume` | `false` | Restored goals/loops/lists auto-resume in fresh sessions. Global-only. |
 | `decisionPopup` | `true` | Decision pauses pop the picker (`false` = widget card only). |
+| `decisionPauseBudget` | unset (unlimited) | Max agent-authored decision pauses per goal before auto-default: the (N+1)-th adopts the recommended option as a logged assumption without pausing. `0` = relentless from the first decision. |
 | `carryover` | `"pause"` | Stale carryover on new activation: `"pause"` / `"clear"` / `"resume"`. |
 | `autoAcceptDrafts` | `false` | Drafts activate without the Confirm dialog (unattended rigs). |
 | `auditCap` | `5` (10 aggressive) | Pause after N consecutive auditor disapprovals (`0` = unlimited). |

package/extensions/completion-summary.ts

@@ -1,5 +1,5 @@
 import { execFileSync } from "node:child_process";
-import type { FindingGroup, GateRow, Goal, Status } from "./goal-loop-core.js";
+import { sanitizeDisplayText, type FindingGroup, type GateRow, type Goal, type Status } from "./goal-loop-core.js";
 import { fmtElapsed, truncateCells } from "./goal-loop-display.js";
 
 /**
@@ -180,9 +180,10 @@ export interface HumanCompletionBrief {
  * the durable archive keeps the full text. Falls back to the original
  * when stripping would empty the value. */
 export function chatSafeDetailValue(value: string): string {
+  const safeValue = sanitizeDisplayText(value);
   // v0.38.45 audit: loop the innermost-group strip to a fixpoint
   // (bounded) — a single pass left nested husks like "(log )" behind.
-  let withoutGroups = stripMachineGroups(value);
+  let withoutGroups = stripMachineGroups(safeValue);
   const stripped = withoutGroups
     .replace(/(?:\/var)?\/tmp\/\S+/g, "")
     .replace(/\btarballs?\s+\S+\.tgz\b/gi, "")
@@ -190,7 +191,7 @@ export function chatSafeDetailValue(value: string): string {
     .replace(/\(\s*\)/g, "")
     .replace(/\s{2,}/g, " ")
     .trim();
-  return stripped || value;
+  return stripped || safeValue;
 }
 
 /** The human briefing: outcome first in its own words, then only the
@@ -384,7 +385,7 @@ function stripMachineTokens(line: string): string {
 export function structuredSummaryLines(summary: string | undefined, label = "Outcome:"): string[] | null {
   const raw = rawLabelValue(summary ?? "", label);
   if (!raw || !isSectionStructured(raw)) return null;
-  const lines = raw.split("\n").map(stripMachineTokens);
+  const lines = raw.split("\n").map((line) => stripMachineTokens(sanitizeDisplayText(line)));
   while (lines.length > 0 && !(lines[0] ?? "").trim()) lines.shift();
   while (lines.length > 0 && !(lines[lines.length - 1] ?? "").trim()) lines.pop();
   let text = lines.join("\n");
@@ -416,7 +417,7 @@ export interface RichTerminalParts {
 }
 
 function escapeTableCell(value: string): string {
-  return value.replace(/\|/g, "\\|").replace(/\s+/g, " ").trim();
+  return sanitizeDisplayText(value).replace(/\|/g, "\\|").replace(/\s+/g, " ").trim();
 }
 
 function testsRowStatus(value: string): string {
@@ -470,9 +471,10 @@ function auditRowStatus(history: Goal["auditHistory"]): string {
 
 /** Split a stale-filtered `Label: value` detail into a bold lead + body. */
 function leadBody(detail: string): { lead: string; body: string } {
-  const separator = detail.indexOf(":");
-  if (separator < 0) return { lead: "Note", body: detail };
-  return { lead: detail.slice(0, separator).trim() || "Note", body: detail.slice(separator + 1).trim() };
+  const safeDetail = sanitizeDisplayText(detail);
+  const separator = safeDetail.indexOf(":");
+  if (separator < 0) return { lead: "Note", body: safeDetail };
+  return { lead: safeDetail.slice(0, separator).trim() || "Note", body: safeDetail.slice(separator + 1).trim() };
 }
 
 /**
@@ -487,7 +489,7 @@ const EVIDENCE_TOKEN_PATTERN = /(?<![/~+\w])[\w.+][\w.+/-]*\.[A-Za-z0-9]{1,8}:\d
 
 export function extractEvidenceTokens(text: string): { text: string; evidence: string[] } {
   const evidence: string[] = [];
-  const stripped = text
+  const stripped = sanitizeDisplayText(text)
     .replace(EVIDENCE_TOKEN_PATTERN, (match) => {
       if (evidence.length < RICH_EVIDENCE_TOKENS_PER_FINDING && !evidence.includes(match)) evidence.push(match);
       // The token often rides in parentheses — move the wrapper too, so
@@ -501,6 +503,29 @@ export function extractEvidenceTokens(text: string): { text: string; evidence: s
   return { text: stripped, evidence };
 }
 
+/**
+ * v0.38.69 (Antigravity port): completion-claim evidence-density lint.
+ * A walkthrough always ships areas + counts; GLLA richness rode optional
+ * agent params, so a flat six-label claim with zero path:line tokens and
+ * zero gate rows still passed. Returns a NOTE annotation when the claim
+ * carries no verifiable pointer at all (no evidence tokens across the
+ * summary and every group finding, and no gate rows) — the claim still
+ * audits, but the terminal render falls back to recorded facts. Tokens in
+ * finding groups count; gate rows count as density without tokens.
+ */
+export function completionSummaryDensityNote(
+  summary: string | undefined,
+  groups?: FindingGroup[],
+  gates?: GateRow[],
+): string | undefined {
+  if (!summary?.trim()) return undefined;
+  const pool = [summary, ...(groups ?? []).flatMap((group) => group.findings ?? [])].join("\n");
+  const { evidence } = extractEvidenceTokens(pool);
+  if (evidence.length > 0) return undefined;
+  if ((gates ?? []).length > 0) return undefined;
+  return "low evidence density: no path:line evidence tokens and no verification gate rows — add file:line pointers (e.g. extensions/goal-recovery.ts:847) or a gateRows inventory so the terminal render is verifiable";
+}
+
 /**
  * v0.38.50: one compact duration line from durable goal state — turns,
  * wall-clock elapsed since creation, and audit count. Only known facts
@@ -509,7 +534,9 @@ export function extractEvidenceTokens(text: string): { text: string; evidence: s
 export function buildDurationLine(goal: Goal, now = Date.now()): string | null {
   const segs: string[] = [];
   const turns = goal.telemetry?.turns;
-  if (typeof turns === "number" && Number.isFinite(turns) && turns >= 0) {
+  // Field 20260918_172705: a zero turns count means untracked telemetry,
+  // not a known fact — omit it while elapsed/audits still render.
+  if (typeof turns === "number" && Number.isFinite(turns) && turns > 0) {
     segs.push(`${turns} turn${turns === 1 ? "" : "s"}`);
   }
   const started = Date.parse(goal.createdAt ?? "");
@@ -519,15 +546,25 @@ export function buildDurationLine(goal: Goal, now = Date.now()): string | null {
   return segs.length > 0 ? `\u2014 ${segs.join(" \u00b7 ")}` : null;
 }
 
-/** Partition informing details into findings / Tests / next buckets. */
+/** Partition informing details into findings / Tests / next buckets.
+ * Field 20260918_172705: exact-duplicate lines collapse to one per bucket
+ * (repeated claim details rendered as doubled rows). Near-duplicates with
+ * different wording still render — that prose belongs to the claim. */
 export function partitionRichDetails(details: string[]): { findings: string[]; tests: string[]; next: string[] } {
+  const seen = new Set<string>();
+  const push = (bucket: string[], detail: string) => {
+    const key = detail.trim();
+    if (seen.has(key)) return;
+    seen.add(key);
+    bucket.push(detail);
+  };
   const findings: string[] = [];
   const tests: string[] = [];
   const next: string[] = [];
   for (const detail of details) {
-    if (/^\s*Tests\s*:/i.test(detail)) tests.push(detail);
-    else if (/^\s*(Next|Unresolved|Left out)\s*:/i.test(detail)) next.push(detail);
-    else findings.push(detail);
+    if (/^\s*Tests\s*:/i.test(detail)) push(tests, detail);
+    else if (/^\s*(Next|Unresolved|Left out)\s*:/i.test(detail)) push(next, detail);
+    else push(findings, detail);
   }
   return { findings, tests, next };
 }
@@ -538,15 +575,17 @@ export function partitionRichDetails(details: string[]): { findings: string[]; t
  * `## Done — outcome` shape stays, so direct unit callers are unaffected.
  */
 export function requestEchoHeadline(kind: "Done" | "Aborted", objective: string | undefined, outcome: string): string {
-  const echo = objective?.trim() ? clipSummaryValue(objective.trim(), RICH_OBJECTIVE_ECHO_CHARS) : null;
-  return echo ? `## ${kind}: ${echo} \u2014 ${outcome}` : `## ${kind} \u2014 ${outcome}`;
+  const safeObjective = objective ? sanitizeDisplayText(objective) : "";
+  const safeOutcome = sanitizeDisplayText(outcome);
+  const echo = safeObjective.trim() ? clipSummaryValue(safeObjective.trim(), RICH_OBJECTIVE_ECHO_CHARS) : null;
+  return echo ? `## ${kind}: ${echo} \u2014 ${safeOutcome}` : `## ${kind} \u2014 ${safeOutcome}`;
 }
 
 /** Chat-only projection: keep explanations and counts, not command/hash receipts.
  * Repository-only findings are filtered separately; useful implementation
  * references in substantive explanations are not themselves bookkeeping. */
 function chatNarrative(value: string): string {
-  return stripMachineGroups(chatSafeDetailValue(value)
+  return stripMachineGroups(chatSafeDetailValue(sanitizeDisplayText(value))
     .replace(/\b(?:fixed in|commit|HEAD(?: at)?|built from)\s+`?[a-f0-9]{7,64}`?/gi, "")
     .replace(/\b(?=[a-f0-9]*[a-f])(?=[a-f0-9]*\d)[a-f0-9]{7,64}\b/gi, "")
     .replace(/`(?:bun|npm|npx|node|git|tsc)\s+[^`]+`/g, "")
@@ -620,9 +659,12 @@ export function buildFinalRepoStateLines(cwd: string): string[] | undefined {
       return undefined;
     }
   };
-  const branch = run(["branch", "--show-current"]);
-  const head = run(["log", "-1", "--format=%h %s"]);
-  const short = run(["status", "--short"]);
+  const branchRaw = run(["branch", "--show-current"]);
+  const headRaw = run(["log", "-1", "--format=%h %s"]);
+  const shortRaw = run(["status", "--short"]);
+  const branch = branchRaw === undefined ? undefined : sanitizeDisplayText(branchRaw);
+  const head = headRaw === undefined ? undefined : sanitizeDisplayText(headRaw);
+  const short = shortRaw === undefined ? undefined : shortRaw.split("\n").map((line) => sanitizeDisplayText(line)).join("\n");
   if (!branch && !head && short === undefined) return undefined;
   const lines = [`Branch ${branch ?? "detached"}${head ? ` @ ${head}` : ""}`];
   if (short === undefined) lines.push("Tree state unreadable");
@@ -660,7 +702,7 @@ export function buildRichTerminalParts(args: {
   chat?: boolean;
 }): RichTerminalParts {
   const { findings, tests, next } = partitionRichDetails(args.details);
-  const outcome = args.outcome;
+  const outcome = sanitizeDisplayText(args.outcome);
   const kind = args.kind ?? "Done";
   const headline = args.chat ? `## ${kind} — ${outcome}` : requestEchoHeadline(kind, args.objective, outcome);
   const auditStatus = auditRowStatus(args.auditHistory);
@@ -676,11 +718,11 @@ export function buildRichTerminalParts(args: {
     findingLines.push("| Area | Finding | Evidence |", "| --- | --- | --- |");
     for (const group of groups) {
       group.findings.forEach((finding, fi) => {
-        const { text, evidence } = extractEvidenceTokens(finding);
+        const { text, evidence } = extractEvidenceTokens(sanitizeDisplayText(finding));
         const { lead, body } = leadBody(text);
         // v0.38.52: test proof rides the Evidence cell (tables have no
         // sub-bullets); cells stay pipe-escaped. v0.38.55: unclipped.
-        const proof = group.tests?.[fi]?.trim();
+        const proof = group.tests?.[fi] ? sanitizeDisplayText(group.tests[fi]).trim() : "";
         const evidenceCell = [evidence.join(", ") || "\u2014", ...(proof ? [`Tests: ${proof}`] : [])].join(" \u00b7 ");
         findingLines.push(
           `| ${escapeTableCell(group.title)} | ${escapeTableCell(`**${lead}** \u2014 ${body}`)} | ${escapeTableCell(evidenceCell)} |`,
@@ -689,12 +731,12 @@ export function buildRichTerminalParts(args: {
     }
   } else if (groups.length > 0) {
     groups.forEach((group, i) => {
-      findingLines.push(`#### ${i + 1}. ${group.title}`);
+      findingLines.push(`#### ${i + 1}. ${sanitizeDisplayText(group.title)}`);
       group.findings.forEach((finding, fi) => {
-        const { lead, body } = leadBody(args.chat ? chatNarrative(extractEvidenceTokens(finding).text) : finding);
+        const { lead, body } = leadBody(args.chat ? chatNarrative(extractEvidenceTokens(finding).text) : sanitizeDisplayText(finding));
         findingLines.push(`- **${lead}** \u2014 ${body}`);
         // v0.38.52: per-finding test proof (shot C) — absent stays absent.
-        const proof = group.tests?.[fi]?.trim();
+        const proof = group.tests?.[fi] ? sanitizeDisplayText(group.tests[fi]).trim() : "";
         if (proof) findingLines.push(`  - Test Results: ${args.chat ? chatNarrative(proof) : proof}`);
       });
     });
@@ -716,22 +758,25 @@ export function buildRichTerminalParts(args: {
   const showCommand = !args.chat && gates.some((row) => row.command?.trim());
   if (gates.length > 0) {
     for (const row of gates) {
-      const derived = testsRowStatus(row.notes ?? "");
-      const notes = args.chat ? chatNarrative(row.notes ?? "") : row.notes?.trim();
-      const command = row.command?.trim() || "\u2014";
+      const safeNotes = row.notes ? sanitizeDisplayText(row.notes).trim() : "";
+      const derived = testsRowStatus(safeNotes);
+      const notes = args.chat ? chatNarrative(safeNotes) : safeNotes;
+      const command = row.command ? sanitizeDisplayText(row.command).trim() : "\u2014";
+      const gate = sanitizeDisplayText(row.gate);
+      const scope = row.scope ? sanitizeDisplayText(row.scope).trim() : "\u2014";
       tableRows.push(showCommand
-        ? `| ${escapeTableCell(row.gate)} | ${escapeTableCell(command)} | ${escapeTableCell(row.scope?.trim() || "\u2014")} | ${derived} | ${escapeTableCell(notes || "\u2014")} |`
-        : `| ${escapeTableCell(row.gate)} | ${escapeTableCell(row.scope?.trim() || "\u2014")} | ${derived} | ${escapeTableCell(notes || "\u2014")} |`);
+        ? `| ${escapeTableCell(gate)} | ${escapeTableCell(command)} | ${escapeTableCell(scope)} | ${derived} | ${escapeTableCell(notes || "\u2014")} |`
+        : `| ${escapeTableCell(gate)} | ${escapeTableCell(scope)} | ${derived} | ${escapeTableCell(notes || "\u2014")} |`);
     }
   } else {
     for (const detail of tests) {
       const { body } = leadBody(detail);
       const status = testsRowStatus(body);
-      tableRows.push(`| Tests | ${status} | ${escapeTableCell(args.chat ? chatNarrative(body) : body)} |`);
+      tableRows.push(`| Tests | ${status} | ${escapeTableCell(args.chat ? chatNarrative(body) : sanitizeDisplayText(body))} |`);
     }
   }
   if (!args.chat && auditStatus !== "NO VERDICT") {
-    const auditBody = args.countsLine.replace(/^\u2014\s*/, "").replace(/\.\s*$/, "");
+    const auditBody = sanitizeDisplayText(args.countsLine).replace(/^\u2014\s*/, "").replace(/\.\s*$/, "");
     // v0.38.55 audit: the Audit row's Scope names the row kind — the old
     // shape duplicated the counts text in Scope and Notes.
     if (gates.length > 0) {
@@ -763,8 +808,8 @@ export function buildRichTerminalParts(args: {
     findingLines,
     tableLines,
     nextLines,
-    repoLines: args.chat ? [] : args.repoState ?? [],
-    summaryLines: args.summaryLines ?? [],
+    repoLines: args.chat ? [] : (args.repoState ?? []).map((line) => sanitizeDisplayText(line)),
+    summaryLines: (args.summaryLines ?? []).map((line) => sanitizeDisplayText(line)),
   };
 }
 
@@ -776,28 +821,30 @@ export function buildRichTerminalParts(args: {
  * final repository state closes it — findings, verification, Next,
  * repo state, in that order. */
 export function composeRichTerminalLines(parts: RichTerminalParts): string[] {
-  const lines = [parts.banner ?? parts.headline, ""];
-  if (parts.headline !== lines[0]) lines.push(parts.headline, "");
-  if (parts.durationLine) lines.push(parts.durationLine, "");
+  const banner = sanitizeDisplayText(parts.banner ?? parts.headline);
+  const headline = sanitizeDisplayText(parts.headline);
+  const lines = [banner, ""];
+  if (headline !== lines[0]) lines.push(headline, "");
+  if (parts.durationLine) lines.push(sanitizeDisplayText(parts.durationLine), "");
   // Structured-long (field 2026-09-16): the full Outcome body rides its
   // own section between the headline and the findings — findings-first
   // order is preserved (findings, verification, Next keep their relative
   // order), the headline echo stays short, and the one-action Next rule
   // is untouched.
   if (parts.summaryLines.length > 0) {
-    lines.push("### Summary", ...parts.summaryLines, "");
+    lines.push("### Summary", ...parts.summaryLines.map((line) => sanitizeDisplayText(line)), "");
   }
   if (parts.findingLines.length > 0) {
-    lines.push("### Key Findings & Remediation", ...parts.findingLines, "");
+    lines.push("### Key Findings & Remediation", ...parts.findingLines.map((line) => sanitizeDisplayText(line)), "");
   }
   if (parts.tableLines.length > 0) {
-    lines.push("### Verification Summary", ...parts.tableLines, "");
+    lines.push("### Verification Summary", ...parts.tableLines.map((line) => sanitizeDisplayText(line)), "");
   }
   if (parts.nextLines.length > 0) {
-    lines.push("### Next", ...parts.nextLines, "");
+    lines.push("### Next", ...parts.nextLines.map((line) => sanitizeDisplayText(line)), "");
   }
   if (parts.repoLines.length > 0) {
-    lines.push("### Final Repository State", ...parts.repoLines.map((line) => `- ${line}`), "");
+    lines.push("### Final Repository State", ...parts.repoLines.map((line) => `- ${sanitizeDisplayText(line)}`), "");
   }
   return lines;
 }
@@ -889,7 +936,7 @@ function stripApprovalModel(line: string): string {
   return line.replace(/auditor\s+\S+\s+approved/, "auditor approved");
 }
 function trailerBullet(line: string): string {
-  return `• ${line.replace(/^—\s*/, "")}`;
+  return `• ${sanitizeDisplayText(line).replace(/^—\s*/, "")}`;
 }
 
 /** v0.38.25: the audit-goal counts line — verdict proof ONLY, built from

package/extensions/goal-continuation.ts

@@ -1420,7 +1420,7 @@ export function sendStallEscalation(ctx: ExtensionContext, nudges: number): void
   if (supervisorPaused(state)) return;
   // Audit 2026-09-07 (HIGH): a stall nudge must not resurrect a stood-down
   // chain — same abort-latch reasoning as sendContinuation.
-  if (flags.sessionHandoffPending || flags.initialSessionLoadPending || !flags.extensionApi || flags.extensionApiStale || continuationDispatchStoodDown || pendingContinuationDispatch || flags.abortedStandDown) return;
+  if (flags.sessionHandoffPending || flags.initialSessionLoadPending || !flags.extensionApi || flags.extensionApiStale || flags.staleTerminalDone || flags.zombieStoodDown || continuationDispatchStoodDown || pendingContinuationDispatch || flags.abortedStandDown) return;
   if (!state.goal || !guardGoalBeforeContinuation(ctx, "stall-escalation")) return;
   const remaining = HEARTBEAT_MAX_NUDGES - nudges;
   const text = [
@@ -1464,7 +1464,7 @@ export function sendLengthContinue(ctx: ExtensionContext, consecutive: number):
   if (supervisorPaused(state)) return;
   // Audit 2026-09-07 (HIGH): a length nudge must not resurrect a stood-down
   // chain — same abort-latch reasoning as sendContinuation.
-  if (flags.sessionHandoffPending || flags.initialSessionLoadPending || !flags.extensionApi || flags.extensionApiStale || continuationDispatchStoodDown || pendingContinuationDispatch || flags.abortedStandDown) return;
+  if (flags.sessionHandoffPending || flags.initialSessionLoadPending || !flags.extensionApi || flags.extensionApiStale || flags.staleTerminalDone || flags.zombieStoodDown || continuationDispatchStoodDown || pendingContinuationDispatch || flags.abortedStandDown) return;
   if (state.goal && !guardGoalBeforeContinuation(ctx, "length-continuation")) return;
   // v0.38.66 (PR #55, FOF11): active goals get completion-aware recovery
   // text — a truncated turn must offer closure, not another blind work
@@ -1525,7 +1525,34 @@ export function buildPostCompactResync(briefExcerpt?: string): string {
   return lines.join("\n") + "\n\n";
 }
 
-export function continuationPrompt(goal: Goal, opts: { includeRestartDetail?: boolean } = {}): string {
+/**
+ * v0.38.69 (Antigravity port, 09-04 borrow candidate #1): per-repo pitfall
+ * registry. `.pi-glla/pitfalls.md` holds distilled, answer-agnostic rakes
+ * (never ledger prose — the ledger is forensics, never distilled). Read at
+ * goal start (and re-read when edited mid-goal); absent/blank/unreadable
+ * resolves absent so repos without one render byte-identical prompts.
+ */
+export const PITFALLS_BRIEF_MAX_CHARS = 1500;
+
+export function readPitfallsBrief(cwd: string): string | undefined {
+  let body: string;
+  try {
+    body = fs.readFileSync(path.join(cwd, ".pi-glla", "pitfalls.md"), "utf8");
+  } catch {
+    return undefined;
+  }
+  const trimmed = body.trim();
+  if (!trimmed) return undefined;
+  return trimmed.length > PITFALLS_BRIEF_MAX_CHARS
+    ? trimmed.slice(0, PITFALLS_BRIEF_MAX_CHARS)
+    : trimmed;
+}
+
+/** Goals already ledgered for their pitfalls consult this process — the
+ * ledger records the consult once per goal, never once per turn. */
+const pitfallsLedgeredGoals = new Set<string>();
+
+export function continuationPrompt(goal: Goal, opts: { includeRestartDetail?: boolean; pitfallsBrief?: string } = {}): string {
   // Read the .md file as the template, then substitute {{tokens}}.
   // For v0.1.0 we inline-substitute so we don't need fs at runtime.
   const next = findNextPendingTask(goal.taskList?.tasks ?? []);
@@ -1583,6 +1610,20 @@ export function continuationPrompt(goal: Goal, opts: { includeRestartDetail?: bo
   if (loadSettings(settingsCwd).visionAssist !== false) {
     directives.push(VISION_ASSIST_GUIDANCE);
   }
+  // v0.38.69 (Antigravity port): the repo pitfall registry rides the
+  // continuation prompt — consulted at goal start, re-read when edited.
+  // Explicit opts win (tests); otherwise the repo file resolves, absent
+  // keeping the prompt byte-identical for repos without one.
+  const pitfallsBrief = opts.pitfallsBrief ?? readPitfallsBrief(settingsCwd);
+  if (pitfallsBrief?.trim()) {
+    directives.push(
+      `## REPO PITFALLS (distilled — consult before acting)\n\nThese rakes already caught this repo. Check your plan against them before the first tool call and before every risky step:\n\n${pitfallsBrief.trim()}`,
+    );
+    if (!pitfallsLedgeredGoals.has(goal.id)) {
+      pitfallsLedgeredGoals.add(goal.id);
+      appendLedger(settingsCwd, "pitfalls_consulted", { goalId: goal.id });
+    }
+  }
   if (effSettings.aggressiveMode && isFullAuditObjective(goal.objective)) {
     directives.push(
       "## FULL-AUDIT MODE (aggressiveMode + survey objective)\n\nThis objective is a survey, not a single fix. Spawn 3+ `scout` subagents NOW — one per subsystem, in a single message so they run in parallel — synthesize their findings, and call `propose_task_list` with the result. Do not start fixing before the task list exists.",

package/extensions/goal-loop-core.ts

@@ -656,6 +656,15 @@ export interface Goal {
   pauseOptions?: string[];
   /** v0.28.22: 1-based index into pauseOptions the agent recommends. */
   pauseRecommended?: number;
+  /** v0.38.69 (Antigravity port): mid-run decision-pause accounting — every
+   * agent-authored kind="decision" pause increments this, in-budget or
+   * not, so the interruption budget has a durable counter across reloads. */
+  midRunDecisionCount?: number;
+  /** v0.38.69 (Antigravity port): decisions auto-resolved to the
+   * recommended default when the budget was exhausted — the assumption
+   * the agent must carry into its completion recap's Left out. Bounded
+   * to the trailing 20. */
+  autoDefaultLog?: Array<{ at: string; reason: string; chosen: string; options: string[] }>;
   /** v0.28.22: ISO time a wait-pause becomes resumable (countdown shown). */
   pauseResumeAt?: string;
   /** v0.35.28 (issue #16): set when glla AUTO-resumed a lapsed wait — the
@@ -1120,6 +1129,11 @@ export interface MainModelRecovery {
   retryAt?: string;
   /** Next preferred-primary health probe while a fallback is serving. */
   primaryProbeAt?: string;
+  /** v0.38.69 (Antigravity port): absolute reset of the quota-walled
+   * primary, stamped when the episode failed over with an explicit
+   * upstream reset hint. While a fallback serves, the background primary
+   * probe fires at this reset instead of the generic probe cadence. */
+  primaryResetAt?: string;
   /** A preferred-primary switch was accepted and awaits one supervised turn. */
   primaryProbeInFlight?: boolean;
   /** Number of completed recovery waits; drives the bounded per-attempt exponential cadence. */
@@ -1228,6 +1242,7 @@ export function sanitizeMainModelRecovery(value: unknown): MainModelRecovery | u
     ...(Array.isArray(raw.recoveryNoticeKeys) ? { recoveryNoticeKeys: raw.recoveryNoticeKeys.filter((key): key is string => typeof key === "string").slice(-16).map((key) => key.slice(0, 300)) } : {}),
     ...(date(raw.retryAt) ? { retryAt: date(raw.retryAt) } : {}),
     ...(date(raw.primaryProbeAt) ? { primaryProbeAt: date(raw.primaryProbeAt) } : {}),
+    ...(date(raw.primaryResetAt) ? { primaryResetAt: date(raw.primaryResetAt) } : {}),
     ...(raw.primaryProbeInFlight === true ? { primaryProbeInFlight: true } : {}),
     ...(date(raw.firstFailureAt) ? { firstFailureAt: date(raw.firstFailureAt) } : {}),
     ...(date(raw.autoRetryUntil) ? { autoRetryUntil: date(raw.autoRetryUntil) } : {}),
@@ -3626,6 +3641,21 @@ export function extractPendingTasks(report: string, cap = 5): string[] {
   return out;
 }
 
+/**
+ * v0.38.69 (Antigravity port): objection-attached retries. Every
+ * disapproval — aggressive or not — becomes a durable TODO projection:
+ * extracted objection bullets, or a single review-the-report TODO when
+ * nothing extractable survives. Never an empty list: the retry argues the
+ * objection, not generic effort. The aggressive gate keeps only the
+ * cap-keep-going / no-progress-stop behaviors, never the TODOs.
+ */
+export function durableObjectionsForDisapproval(report: string, statusCommand = "/goal status"): string[] {
+  const extracted = extractPendingTasks(report, 5);
+  return extracted.length > 0
+    ? extracted
+    : [`Review the latest auditor disapproval in ${statusCommand}.`];
+}
+
 /** Contract item 23: is the auditor's IMPOSSIBLE reason about the WHOLE
  * goal or only part of it? Default "full" (safe — keeps the pause);
  * partial only on explicit subset language. */

package/extensions/goal-recovery.ts

@@ -31,6 +31,8 @@ import {
   mainModelFailureDelayMs,
   mainModelPrimaryProbeDelayMs,
   mainModelRetryDelayMs,
+  isQuotaHorizonExempt,
+  quotaResetSleepMs,
   isCompactionInFlightSince,
   MAIN_MODEL_AUTO_RETRY_HORIZON_MS,
   modelRef,
@@ -352,7 +354,10 @@ export function observeCompactFailure(ctx: ExtensionContext, error: string | und
  * current public event API returns false and the caller uses the terminal
  * park with an explicit `/new` instruction instead of claiming recovery.
  *
- * The signature is `where: string` so every attempt/skip is observable. */
+ * The signature is `where: string` so every attempt/skip is observable. A
+ * recovery is successful only when the host synchronously supplies the
+ * replacement context. Async host calls are fail-closed: callers must park
+ * the stale handle instead of treating invocation as recovery. */
 export function attemptFreshSessionRecovery(ctx: ExtensionContext, where: string): boolean {
   type FreshSessionContext = ExtensionContext & {
     newSession?: (options?: {
@@ -384,8 +389,16 @@ export function attemptFreshSessionRecovery(ctx: ExtensionContext, where: string
     return false;
   }
   try {
+    let rebound = false;
+    let failureRecorded = false;
+    const recordFailure = (error: string): void => {
+      if (failureRecorded) return;
+      failureRecorded = true;
+      appendLedger(recoveryCwd, "fresh_session_recovery_failed", { from: where, error });
+    };
     const result = startNewSession.call(freshCtx, {
-      withSession: async (replacementCtx) => {
+      withSession: (replacementCtx) => {
+        rebound = true;
         appendLedger(replacementCtx.cwd, "fresh_session_recovery_rebound", { where });
         replacementCtx.ui.notify(
           "glla: stale ctx detected — host supplied a fresh-session capability; rehydrating the goal now.",
@@ -394,12 +407,23 @@ export function attemptFreshSessionRecovery(ctx: ExtensionContext, where: string
       },
     });
     if (result && typeof (result as Promise<unknown>).then === "function") {
-      // The new session_start rehydrates the goal from disk. Do not await
-      // here: this send already failed on the stale context, and waiting on
-      // the replacement would touch the invalidated context again.
-      (result as Promise<unknown>).catch((err) => {
-        appendLedger(recoveryCwd, "fresh_session_recovery_failed", { from: where, error: err instanceof Error ? err.message : String(err) });
-      });
+      // Do not let a rejected or callback-free async host call masquerade as
+      // recovery. The caller fails closed immediately when `rebound` is
+      // still false; this continuation only records the eventual outcome.
+      (result as Promise<unknown>).then(
+        () => {
+          if (!rebound) recordFailure("host completed without supplying a replacement context");
+        },
+        (err) => {
+          recordFailure(err instanceof Error ? err.message : String(err));
+        },
+      );
+    }
+    if (!rebound) {
+      recordFailure(result && typeof (result as Promise<unknown>).then === "function"
+        ? "host recovery is asynchronous; no replacement context was supplied synchronously"
+        : "host recovery returned without supplying a replacement context");
+      return false;
     }
     appendLedger(recoveryCwd, "fresh_session_recovery_triggered", { from: where });
     return true;
@@ -635,6 +659,18 @@ export async function tryMainModelFallback(ctx: ExtensionContext, failure: MainM
     recoveryEpisodeKey: baseRecovery.recoveryEpisodeKey ?? `${baseRecovery.firstFailureAt ?? nowIso()}:${failureCopy.fingerprint}`,
     recoveryNoticeKeys: baseRecovery.recoveryNoticeKeys ?? [],
   };
+  // v0.38.69 (Antigravity port): a quota-walled primary carries its reset
+  // forward into the episode, so the background primary probe fires at
+  // reset instead of the generic cadence while fallback-chain work
+  // proceeds. Stamped only for failures ON the primary — a fallback's own
+  // wall says nothing about when the primary recovers — and never cleared
+  // here, so later fallback failures cannot erase the primary's reset.
+  if (sameModelRef(current, recovery.primary)) {
+    const resetSleep = quotaResetSleepMs(failure);
+    if (resetSleep !== undefined) {
+      recovery.primaryResetAt = new Date(Date.now() + resetSleep).toISOString();
+    }
+  }
   if (!recovery.attempted.includes(current)) recovery.attempted.push(current);
   const selector = sessionModelSelector(ctx);
   const scope: ModelScope = { kind: "session" };
@@ -701,8 +737,9 @@ export async function tryMainModelFallback(ctx: ExtensionContext, failure: MainM
       // never invoke setModel on that stale generation.
       if (generation !== flags.sessionGeneration || !freshCtxForGeneration(generation)) return false;
       const api = flags.extensionApi;
+      if (supervisorPaused(state)) return false;
       const accepted = await api?.setModel(candidate);
-      if (generation !== flags.sessionGeneration || !freshCtxForGeneration(generation)) return false;
+      if (generation !== flags.sessionGeneration || !freshCtxForGeneration(generation) || supervisorPaused(state)) return false;
       if (state.mainModelRecovery?.pendingModelSwitch?.toLowerCase() !== candidateRef.toLowerCase()) return false;
       if (!accepted) {
         state.mainModelRecovery = { ...state.mainModelRecovery, pendingModelSwitch: undefined, retryAt: undefined };
@@ -764,7 +801,13 @@ export function setMainModelRecoveryPause(ctx: ExtensionContext, recovery: MainM
   const now = Date.now();
   const deadlineMs = normalized.autoRetryUntil ? Date.parse(normalized.autoRetryUntil) : Number.NaN;
   const requestedDelayMs = Math.max(1_000, delayMs);
-  if (normalized.manualResumeRequired || (!aggressive && Number.isFinite(deadlineMs) && (now >= deadlineMs || now + requestedDelayMs > deadlineMs))) {
+  // v0.38.69 (Antigravity port): quota waits never park at the horizon —
+  // a rate-limit/plan-quota wall is transient, so the hold below is
+  // skipped and the wait re-arms. Billing and non-quota failures keep
+  // their horizon park.
+  const horizonApplies = !aggressive
+    && !isQuotaHorizonExempt(normalized.providerErrorDiagnostic ?? normalized.reason);
+  if (normalized.manualResumeRequired || (horizonApplies && Number.isFinite(deadlineMs) && (now >= deadlineMs || now + requestedDelayMs > deadlineMs))) {
     holdMainModelRecovery(ctx, normalized, Number.isFinite(deadlineMs) && now >= deadlineMs
       ? "the 24h automatic recovery horizon was reached"
       : "the automatic recovery horizon would be exceeded");
@@ -942,6 +985,12 @@ export function scheduleHourlyProbe(ctx: ExtensionContext): void {
  * recovery path's timer cleanup, and a generation/host check prevents a
  * stale session from creating a new timer. */
 export async function fireHourlyProbe(ctx: ExtensionContext): Promise<void> {
+  // /glla pause may race an already-dequeued timer. Re-arm the parked slot
+  // without probing so explicit resume still has a durable backstop.
+  if (supervisorPaused(state)) {
+    scheduleHourlyProbe(ctx);
+    return;
+  }
   if (!state.mainModelRecovery || state.mainModelRecovery.manualResumeRequired === true) {
     await fireHourlyProbeForParkedAuditor(ctx);
     // Keep the backstop alive: the consumed :00:30 slot cleared its own
@@ -972,6 +1021,7 @@ export async function fireHourlyProbe(ctx: ExtensionContext): Promise<void> {
     at: new Date().toISOString(),
   });
   try {
+    if (supervisorPaused(state)) return;
     await probeMainModelRecovery(ctx);
   } catch (err) {
     if (isStaleApiError(err)) flags.extensionApiStale = true;
@@ -992,6 +1042,7 @@ export async function fireHourlyProbe(ctx: ExtensionContext): Promise<void> {
  * no-ops on the phase guard inside retryStoredCompletionAudit. Never
  * touches models: a detached audit launch cannot disturb a supervised turn. */
 async function fireHourlyProbeForParkedAuditor(ctx: ExtensionContext): Promise<void> {
+  if (supervisorPaused(state)) return;
   const goal = state.goal;
   if (!goal || goal.status !== "paused") return;
   const pending = goal.pendingCompletion;
@@ -1014,6 +1065,7 @@ async function fireHourlyProbeForParkedAuditor(ctx: ExtensionContext): Promise<v
     at: new Date().toISOString(),
     pauseResumeAt: goal.pauseResumeAt ?? null,
   });
+  if (supervisorPaused(state)) return;
   await retryStoredCompletionAudit("provider-retry");
 }
 
@@ -1081,6 +1133,7 @@ let hourlyProbeGeneration: number | null = null;
  * durable timer state is not enough to fence the two callbacks once both
  * have fired, so serialize the actual async probe as well. */
 export async function probeMainModelRecovery(ctx: ExtensionContext): Promise<void> {
+  if (supervisorPaused(state)) return;
   const generation = flags.sessionGeneration;
   if (mainModelRecoveryProbeInFlight && mainModelRecoveryProbeGeneration !== generation) {
     mainModelRecoveryProbeInFlight = false;
@@ -1205,8 +1258,9 @@ async function probePreferredPrimary(ctx: ExtensionContext, recovery: MainModelR
   flags.mainModelSwitchInFlight = true;
   try {
     if (generation !== flags.sessionGeneration || !freshCtxForGeneration(generation)) return;
+    if (supervisorPaused(state)) return;
     const accepted = await flags.extensionApi?.setModel(candidate);
-    if (generation !== flags.sessionGeneration || !freshCtxForGeneration(generation)) return;
+    if (generation !== flags.sessionGeneration || !freshCtxForGeneration(generation) || supervisorPaused(state)) return;
     if (state.mainModelRecovery?.pendingModelSwitch?.toLowerCase() !== primary.toLowerCase()) return;
     if (!accepted) throw new Error("no configured auth for preferred primary");
     const switched = {
@@ -1252,6 +1306,7 @@ async function probePreferredPrimary(ctx: ExtensionContext, recovery: MainModelR
 }
 
 async function probeMainModelRecoveryImpl(ctx: ExtensionContext): Promise<void> {
+  if (supervisorPaused(state)) return;
   const generation = flags.sessionGeneration;
   const recovery = state.mainModelRecovery;
   if (!recovery) return;
@@ -1399,7 +1454,10 @@ async function probeMainModelRecoveryImpl(ctx: ExtensionContext): Promise<void>
       try { return resolveEffectiveAggressiveSettings(loadSettings(ctx.cwd)).aggressiveMode; } catch { return false; }
     })();
     const horizonMs = next.autoRetryUntil ? Date.parse(next.autoRetryUntil) : Number.NaN;
-    if (next.manualResumeRequired || (!aggressive && Number.isFinite(horizonMs) && Date.now() >= horizonMs)) {
+    // v0.38.69: quota waits skip the horizon hold here too (see
+    // setMainModelRecoveryPause) — a wall outliving 24h still resumes.
+    const quotaExempt = isQuotaHorizonExempt(next.providerErrorDiagnostic ?? next.reason);
+    if (next.manualResumeRequired || (!aggressive && !quotaExempt && Number.isFinite(horizonMs) && Date.now() >= horizonMs)) {
       holdMainModelRecovery(ctx, next, "the 24h automatic recovery horizon was reached");
       return;
     }
@@ -1500,8 +1558,9 @@ async function probeMainModelRecoveryImpl(ctx: ExtensionContext): Promise<void>
       resumeCurrent: (state.mainModelRecovery ?? recovery).resumeCurrent,
       pendingModelSwitch: undefined,
     });
-    // All provider failures use the same bounded envelope. Error text and
-    // upstream retry hints do not alter the delay.
+    // All provider failures use the same bounded envelope. Only an explicit
+    // upstream quota-reset hint alters the delay (sleep until reset, 5h
+    // cap); all other error text and retry hints keep the ladder.
     const delay = mainModelFailureDelayMs(failure, next.attempts, loadGlobalSettings().mainModelRetryMinutes);
     if (setMainModelRecoveryPause(ctx, next, delay)) scheduleMainModelRecoveryTimer(ctx, delay);
   } finally {
@@ -1539,7 +1598,9 @@ export function parkMainModelAfterFailure(ctx: ExtensionContext, failure: MainMo
     resumeCurrent: existing.resumeCurrent,
   });
   // The generic envelope owns the wait; the 24h horizon ends automatic
-  // probes regardless of the provider's wording.
+  // probes regardless of the provider's wording. (A quota-class failure
+  // with an explicit upstream reset hint sleeps until reset inside the
+  // same 5h-capped envelope via mainModelFailureDelayMs.)
   const delay = mainModelFailureDelayMs(failure, nextRecovery.attempts, loadGlobalSettings().mainModelRetryMinutes);
   if (!setMainModelRecoveryPause(ctx, nextRecovery, delay)) return;
   flags.mainModelAbortForRecovery = true;
@@ -1599,7 +1660,17 @@ export function mainModelRecoverySucceeded(ctx: ExtensionContext): void {
 
     const probeAt = alreadyScheduled
       ? existingProbeAt!
-      : new Date(Date.now() + mainModelPrimaryProbeDelay()).toISOString();
+      : new Date(Math.max(
+        Date.now() + mainModelPrimaryProbeDelay(),
+        // v0.38.69 (Antigravity port): the primary failed with an explicit
+        // quota reset, and the fallback is serving — probe AT the reset,
+        // not on the generic cadence, so a known-walled primary is not
+        // hammered every 15m while work proceeds on the chain.
+        (() => {
+          const resetMs = recovery.primaryResetAt ? Date.parse(recovery.primaryResetAt) : Number.NaN;
+          return Number.isFinite(resetMs) ? resetMs : 0;
+        })(),
+      )).toISOString();
     const nextRecovery: MainModelRecovery = {
       ...recovery,
       active: current,

package/extensions/goal-settings.ts

@@ -191,6 +191,15 @@ export interface Settings {
    * widget card still shows the options; /goal decide opens it on demand).
    * Default on; unattended rigs have no UI so this never fires there. */
   decisionPopup?: boolean;
+  /** v0.38.69 (Antigravity port): maximum agent-authored decision pauses
+   * per goal before the run stops blocking on a human. The (N+1)-th
+   * decision pause does NOT pause: the goal stays active and the
+   * recommended option is adopted as a logged assumption (goal
+   * autoDefaultLog + `decision_budget_auto_default` ledger line), which
+   * the agent must carry into its completion recap's Left out. Unset =
+   * unlimited (legacy pause-every-time). `0` = relentless: the first
+   * decision already auto-defaults. */
+  decisionPauseBudget?: number;
   /** v0.28.14: what happens to stale carryover (paused goal, waiting list,
    * held loop from before this session) when NEW work activates.
    * pause (default) = leave it + ONE summary; clear = drop it all honestly;
@@ -554,6 +563,7 @@ export function normalizeLoadedSettings(settings: Settings): Settings {
     delete settings.carryover;
   }
   if (typeof settings.decisionPopup !== "boolean") delete settings.decisionPopup;
+  if (settings.decisionPauseBudget !== undefined && (!Number.isInteger(settings.decisionPauseBudget) || settings.decisionPauseBudget < 0)) delete settings.decisionPauseBudget;
   if (typeof settings.aggressiveMode !== "boolean") delete settings.aggressiveMode;
   if (typeof settings.autoResume !== "boolean") delete settings.autoResume;
   if (typeof settings.autoAcceptDrafts !== "boolean") delete settings.autoAcceptDrafts;

package/extensions/loops/goal-auditor-hooks.ts

@@ -51,7 +51,8 @@ import {
   DEFAULT_STALL_ESCALATION_REFIRES,
   DEFAULT_TOKEN_LIMIT,
   classifyImpossibleReason,
-  extractPendingTasks,
+  durableObjectionsForDisapproval,
+extractPendingTasks,
   isFullAuditObjective,
   resolveEffectiveAggressiveSettings,
   appendAuditLog,
@@ -1958,15 +1959,12 @@ async function retryStoredCompletionAudit(origin: CompletionAuditOrigin = "provi
   const effectiveCap = resolveEffectiveAggressiveSettings(loadSettings(liveCtx.cwd));
   const auditCap = effectiveCap.auditCap;
   const trailingDisapprovals = countTrailingDisapprovals(history);
-  const durableObjections = result.disapproved && aggressive
-    ? (() => {
-      const extracted = extractPendingTasks(sanitizeProviderAuditReport(result.output), 5);
-      return extracted.length > 0
-        ? extracted
-        : [`Review the latest auditor disapproval in ${activeGoalStatusCommand()}.`];
-    })()
+  const durableObjections = result.disapproved
+    ? durableObjectionsForDisapproval(sanitizeProviderAuditReport(result.output), activeGoalStatusCommand())
     : [];
-  if (result.disapproved && aggressive) {
+  // v0.38.69 (Antigravity port): objections attach on EVERY disapproval —
+  // the retry argues the objection, not generic effort.
+  if (result.disapproved) {
     appendLedger(liveCtx.cwd, "audit_objections_todo", {
       goalId,
       attemptId: claim.attemptId,

package/extensions/loops/goal-tools.ts

@@ -56,7 +56,8 @@ import {
   DEFAULT_STALL_ESCALATION_REFIRES,
   DEFAULT_TOKEN_LIMIT,
   classifyImpossibleReason,
-  extractPendingTasks,
+  durableObjectionsForDisapproval,
+extractPendingTasks,
   isFullAuditObjective,
   resolveEffectiveAggressiveSettings,
   appendAuditLog,
@@ -274,7 +275,7 @@ import {
   pushCapped as pushRepetitionCapped,
 } from "../goal-loop-repetition.js";
 import { buildStatusText, buildWidgetLines, type AuditDisplayProgress } from "../goal-loop-display.js";
-import { buildFinalRepoStateLines, buildTerminalApprovalRender, compactCompletionSummary, compactTerminalCompletionSummary } from "../completion-summary.js";
+import { buildFinalRepoStateLines, buildTerminalApprovalRender, compactCompletionSummary, compactTerminalCompletionSummary, completionSummaryDensityNote } from "../completion-summary.js";
 import { persistApprovalRender, replayUndeliveredApprovalRenders } from "../approval-render-store.js";
 import { resolveAuditorThinkingLevel } from "../auditor-thinking.js";
 import {
@@ -838,6 +839,17 @@ function registerAgentTools(pi: any): void {
       // v0.38.52: same for the agent-supplied gate inventory.
       const sanitizedGroups = sanitizeFindingGroups(p.findingGroups);
       const sanitizedGates = sanitizeGateRows(p.gateRows);
+      // v0.38.69 (Antigravity port): evidence-density lint — a claim with
+      // no path:line tokens and no gate rows still audits, but rides with
+      // a NOTE annotation (ledgered) so the terminal render falls back to
+      // recorded facts instead of rendering unverifiable prose as proof.
+      const densityNote = completionSummaryDensityNote(finalSummary, sanitizedGroups, sanitizedGates);
+      const claimedSummary = densityNote && finalSummary
+        ? `${finalSummary.trimEnd()} — NOTE: ${densityNote}`
+        : finalSummary;
+      if (densityNote) {
+        appendLedger(ctx.cwd, "completion_summary_low_density", { excerpt: (finalSummary ?? "").slice(0, 240) });
+      }
       // 2026-09-16 whole-work recap: a re-claim after an auditor disapproval
       // is usually a delta-only repair note. Keep the FIRST claim's text so
       // the approved terminal render still opens with the whole work; the
@@ -849,7 +861,7 @@ function registerAgentTools(pi: any): void {
           ? state.goal.completionSummary
           : undefined;
       const completionClaim = beginCompletionAudit(ctx, {
-        completionSummary: finalSummary,
+        completionSummary: claimedSummary,
         verificationSummary: p.verificationSummary,
         // v0.38.37: the deliberate non-do rides the pending claim into
         // the terminal render — the only source the summary may cite.
@@ -870,7 +882,7 @@ function registerAgentTools(pi: any): void {
           isError: true,
         };
       }
-      updateGoal({ pendingTasks: undefined, ...(finalSummary ? { completionSummary: finalSummary } : {}) }, ctx);
+      updateGoal({ pendingTasks: undefined, ...(claimedSummary ? { completionSummary: claimedSummary } : {}) }, ctx);
       const auditGoal = state.goal;
       if (!auditGoal) return staleToolResult();
       const auditGoalId = auditGoal.id;
@@ -1976,15 +1988,11 @@ function registerAgentTools(pi: any): void {
       const auditFeedbackTruncationHint = auditFeedbackIsFull
         ? ""
         : `\n\nReport truncated at the configured limit. ${activeGoalStatusCommand()} shows the full report; change Audit feedback chars in /glla settings (0 = full report).`; 
-      const durableObjections = result.disapproved && effectiveCap.aggressiveMode
-        ? (() => {
-          const extracted = extractPendingTasks(safeAuditOutput, 5);
-          return extracted.length > 0
-            ? extracted
-            : [`Review the latest auditor disapproval in ${activeGoalStatusCommand()}.`];
-        })()
+      const durableObjections = result.disapproved
+        ? durableObjectionsForDisapproval(safeAuditOutput, activeGoalStatusCommand())
         : [];
-      if (result.disapproved && effectiveCap.aggressiveMode) {
+      // v0.38.69 (Antigravity port): objections attach on EVERY disapproval.
+      if (result.disapproved) {
         // v0.36.0: every ordinary disapproval becomes the current durable
         // TODO projection, not only the post-cap case. Replacing (rather than
         // appending) the bounded list makes repeated identical reports
@@ -2325,6 +2333,51 @@ function registerAgentTools(pi: any): void {
           storedResumeAt = p.resumeAt;
         }
       }
+      // v0.38.69 (Antigravity port): mid-run interruption budget with
+      // auto-default-and-log fallback. Antigravity's no-mid-run-questions
+      // trick is structural — the run cannot block on a human — while
+      // GLLA's was rhetorical (the continuation prompt says don't ask).
+      // With decisionPauseBudget set, the (N+1)-th agent-authored decision
+      // pause does NOT pause and does NOT abort the turn: the goal stays
+      // active, the recommended option (or option 1 when none is
+      // recommended) is adopted as a logged assumption, and the agent is
+      // told to carry it into its completion recap's Left out. Unset
+      // budget = legacy pause-every-time; 0 = relentless from the start.
+      if (p.kind === "decision" && p.options && p.options.length > 0) {
+        const budgetRaw = loadSettings(ctx.cwd).decisionPauseBudget;
+        const budget = typeof budgetRaw === "number" && Number.isInteger(budgetRaw) && budgetRaw >= 0 ? budgetRaw : undefined;
+        const decisionCount = (state.goal.midRunDecisionCount ?? 0) + 1;
+        if (budget !== undefined && decisionCount > budget) {
+          const recIdx = p.recommended && p.recommended >= 1 && p.recommended <= p.options.length
+            ? Math.floor(p.recommended) - 1
+            : 0;
+          const chosen = p.options[recIdx]!;
+          const entry = {
+            at: new Date().toISOString(),
+            reason: (p.reason ?? "").slice(0, 300),
+            chosen: chosen.slice(0, 300),
+            options: p.options.map((o) => o.slice(0, 200)).slice(0, 10),
+          };
+          updateGoal({
+            midRunDecisionCount: decisionCount,
+            autoDefaultLog: [...(state.goal.autoDefaultLog ?? []), entry].slice(-20),
+          }, ctx);
+          appendLedger(ctx.cwd, "decision_budget_auto_default", {
+            goalId: state.goal.id,
+            budget,
+            decisionCount,
+            chosen,
+            reason: p.reason,
+          });
+          return {
+            content: [{
+              type: "text",
+              text: `Decision budget exhausted (budget ${budget}, this is mid-run decision #${decisionCount}): NOT paused — proceeding with the recommended default, option ${recIdx + 1}: "${chosen}". This assumption is logged on the goal (autoDefaultLog) and ledgered as decision_budget_auto_default. Keep working — record it in your completion summary's Left out: "assumed ${chosen} for: ${(p.reason ?? "").slice(0, 160)}".`,
+            }],
+            details: {},
+          };
+        }
+      }
       updateGoal({
         status: "paused",
         pauseReason: safePauseReason,
@@ -2333,6 +2386,12 @@ function registerAgentTools(pi: any): void {
         pauseOptions: p.kind === "decision" && p.options && p.options.length > 0 ? p.options : undefined,
         pauseRecommended: p.kind === "decision" && p.recommended && p.recommended >= 1 ? Math.floor(p.recommended) : undefined,
         pauseResumeAt: storedResumeAt,
+        // v0.38.69 (Antigravity port): every agent-authored decision
+        // pause counts against the mid-run interruption budget, in-budget
+        // or not, so the counter survives reloads on the goal itself.
+        ...(p.kind === "decision" && p.options && p.options.length > 0
+          ? { midRunDecisionCount: (state.goal.midRunDecisionCount ?? 0) + 1 }
+          : {}),
       }, ctx);
       if (p.kind === "decision" && p.options && p.options.length > 0) maybeDecisionPopup(ctx);
       // v0.27.1: surface the FULL pause contract — reason AND suggested

package/extensions/main-model-recovery.ts

@@ -5,6 +5,8 @@
 // configured candidates, recognizes positively non-recoverable failures, and
 // computes a bounded-but-persistent retry cadence.
 
+import { DEFAULT_QUOTA_RETRY_SEC, parseQuotaError, quotaSignal } from "./quota-retry.js";
+
 export const MAIN_MODEL_MAX_RETRY_DELAY_MS = 5 * 60 * 60_000;
 export const MAIN_MODEL_AUTO_RETRY_HORIZON_MS = 24 * 60 * 60_000;
 export const DEFAULT_MAIN_MODEL_PRIMARY_PROBE_MINUTES = 15;
@@ -291,16 +293,53 @@ export function hourAlignedRetryDelayMs(nowMs = Date.now()): number {
 }
 
 /** One uniform envelope for EVERY provider failure. Error text and upstream
- * Retry-After prose are not trusted to choose a cadence. Every recoverable
- * failure gets the same eager first retry, then the bounded configured ladder;
- * the separate hourly retry adds the :00:30 slot. */
+ * Retry-After prose are not trusted to choose a cadence — EXCEPT one
+ * Antigravity-ported carve-out (v0.38.69): a quota-class failure
+ * (rate-limit/plan-quota signal) carrying an EXPLICIT upstream reset hint
+ * sleeps exactly until reset instead of laddering blindly into a known
+ * wall. The hint never widens the envelope (5h per-attempt cap), the eager
+ * first retry stays eager, and non-quota signals (transient, billing,
+ * unknown) keep the blind ladder — billing still heads for its park.
+ * Every other recoverable failure gets the same eager first retry, then
+ * the bounded configured ladder; the separate hourly retry adds the
+ * :00:30 slot. */
 export function mainModelFailureDelayMs(failure: MainModelFailure, attempt: number, baseMinutes = 15, nowMs = Date.now()): number {
-  void failure;
-  void nowMs;
   if (attempt <= 1) return 5_000;
+  const resetSleep = quotaResetSleepMs(failure, nowMs);
+  if (resetSleep !== undefined) return resetSleep;
   return mainModelRetryDelayMs(attempt, baseMinutes);
 }
 
+/** v0.38.69 (Antigravity port): quota waits never park at the horizon.
+ * A rate-limit/plan-quota wall is transient by definition — agy
+ * busy-retries it until reset — so the 24h automatic-recovery hold must
+ * not end a quota wait. Billing (account wall, not a transient) and every
+ * non-quota failure keep their horizon park. Derived from the episode
+ * diagnostic text at the hold site, so no new durable state is needed and
+ * reloads classify identically. */
+export function isQuotaHorizonExempt(raw: string | undefined): boolean {
+  if (typeof raw !== "string" || !raw.trim()) return false;
+  const signal = quotaSignal(raw);
+  return signal === "rate-limit" || signal === "plan-quota";
+}
+
+/** v0.38.69 (Antigravity port): sleep-until-reset for quota-class failures
+ * with an explicit upstream reset hint. Returns undefined (keep the blind
+ * ladder) unless ALL hold: a rate-limit/plan-quota signal, an upstream
+ * hint (header, JSON field, or explicit retry prose — never the silent
+ * fallback), and a finite non-negative window. The result is floored at
+ * the eager-retry quantum and capped at the per-attempt envelope, so a
+ * "retry in 1 week" wall sleeps 5h and re-evaluates instead of parking
+ * blind or sleeping unbounded. */
+export function quotaResetSleepMs(failure: MainModelFailure, nowMs = Date.now()): number | undefined {
+  if (!failure || typeof failure.raw !== "string" || !failure.raw.trim()) return undefined;
+  const parsed = parseQuotaError(failure.raw, DEFAULT_QUOTA_RETRY_SEC, nowMs);
+  if (!parsed.fromUpstream) return undefined;
+  if (parsed.signal !== "rate-limit" && parsed.signal !== "plan-quota") return undefined;
+  if (!Number.isFinite(parsed.retryAfterSec) || parsed.retryAfterSec < 0) return undefined;
+  return Math.min(Math.max(Math.round(parsed.retryAfterSec * 1000), 5_000), MAIN_MODEL_MAX_RETRY_DELAY_MS);
+}
+
 /** Bound for positively-identified in-flight compaction. session_before_compact
  * arms the marker and session_compact (or the next live host event) clears
  * it; the cap only bounds a lost clear (cancelled compaction with no event,

package/package.json

@@ -1,7 +1,7 @@
 {
 	"name": "pi-goal-list-loop-audit",
-	"version": "0.38.68",
-	"description": "Mission control for autonomous pi: interview-drafted goals, an audited task queue, and forever-loops (metric, spec, project-audit) that run for hours. A detached extension-less auditor process re-verifies every completion with raw evidence without holding the main pi turn; confirmed drafts, decision pauses and consent gates keep you in charge.",
+	"version": "0.38.69",
+	"description": "Mission control for long running pi work: interview drafted goals, an audited task queue, and metric or audit loops that run for hours. Every completion is rechecked by a detached auditor with raw evidence, while Confirm drafts, decision pauses, and consent gates keep you in charge.",
 	"license": "AGPL-3.0-only",
 	"author": "dracon",
 	"type": "module",

package/schemas/goal.schema.json

@@ -59,6 +59,20 @@
     "pauseKind": { "type": "string", "enum": ["decision", "error", "wait", "blocked", "standby"] },
     "pauseOptions": { "type": "array", "items": { "type": "string" } },
     "pauseRecommended": { "type": "number" },
+    "midRunDecisionCount": { "type": "number" },
+    "autoDefaultLog": {
+      "type": "array",
+      "maxItems": 20,
+      "items": {
+        "type": "object",
+        "properties": {
+          "at": { "type": "string" },
+          "reason": { "type": "string" },
+          "chosen": { "type": "string" },
+          "options": { "type": "array", "items": { "type": "string" } }
+        }
+      }
+    },
     "pauseResumeAt": { "type": "string" },
   "autoResumedAt": { "type": "string", "description": "v0.35.28 issue #16: ISO time glla auto-resumed a lapsed wait; renders the RECOVERY NOTICE in the continuation prompt; cleared by manual /goal resume" },
   "autoResumedEvent": { "type": "string", "description": "v0.35.28 issue #16: what auto-resumed the goal (overdue wait route, provider recovery event)" },

package/scripts/release-pack-smoke.mjs

@@ -8,9 +8,11 @@
  */
 
 import { execFileSync } from "node:child_process";
+import { createHash } from "node:crypto";
 import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
+import { pathToFileURL } from "node:url";
 import { createJiti } from "jiti";
 
 const repoRoot = path.resolve(import.meta.dirname, "..");
@@ -80,7 +82,6 @@ try {
     tarball,
     "--ignore-scripts",
     "--omit=dev",
-    "--legacy-peer-deps",
     "--no-save",
     "--prefix",
     installPrefix,
@@ -88,30 +89,66 @@ try {
 
   const installedPackage = path.join(installPrefix, "node_modules", packageName);
   if (!fs.existsSync(installedPackage)) throw new Error(`packed package was not installed at ${installedPackage}`);
-  const nodeModules = path.join(repoRoot, "node_modules");
-  const jiti = createJiti(import.meta.url, {
-    moduleCache: false,
-    alias: {
-      "@earendil-works/pi-agent-core": path.join(nodeModules, "@earendil-works/pi-agent-core"),
-      "@earendil-works/pi-ai": path.join(nodeModules, "@earendil-works/pi-ai"),
-      "@earendil-works/pi-coding-agent": path.join(nodeModules, "@earendil-works/pi-coding-agent"),
-      "@earendil-works/pi-tui": path.join(nodeModules, "@earendil-works/pi-tui"),
-      // Audit 2026-09-06: the @tintinweb/pi-subagents alias was stale
-      // tintinweb-era drift — nothing imports the scoped name and the
-      // package depends on unscoped pi-subagents (which no extension
-      // imports directly, so no alias is needed).
-      // TypeBox exposes only an ESM `exports` entry; point Jiti at that
-      // concrete module because the disposable install intentionally omits
-      // peer dependencies.
-      typebox: path.join(nodeModules, "typebox", "build", "index.mjs"),
-    },
-  });
+  // Load the packed extension with the disposable install's own peer tree.
+  // Never alias imports back to this checkout: that masks a published peer
+  // declaration or an artifact-only module-resolution failure.
+  const jiti = createJiti(pathToFileURL(installedPackage).href, { moduleCache: false });
 
   const activate = await jiti.import(path.join(installedPackage, "extensions/loops/goal.ts"), { default: true });
   if (typeof activate !== "function") throw new Error("packed extension entry did not export a default activation function");
   const auditor = await jiti.import(path.join(installedPackage, "extensions/goal-loop-auditor-process.ts"));
   if (typeof auditor.resolveWorkerCommand !== "function") throw new Error("packed auditor process did not expose its worker command resolver");
   if (auditor.resolveWorkerCommand("/usr/bin/node") !== "/usr/bin/node") throw new Error("packed auditor resolver returned an unexpected command");
+  const packedLauncher = await import(pathToFileURL(path.join(installedPackage, "scripts/goal-auditor-launch.mjs")).href);
+  if (typeof packedLauncher.buildAuditorPiSpawnSpec !== "function") throw new Error("packed launcher did not load");
+  if (typeof packedLauncher.renameWithWindowsRetry !== "function") throw new Error("packed launcher exports are incomplete");
+
+  // Tar-list presence is not worker coverage. Start the shipped worker from
+  // the installed tree with a tiny RPC stub, then require its real result.json
+  // protocol to complete within the smoke timeout.
+  const stableJson = (value) => {
+    if (value === null || typeof value !== "object") return JSON.stringify(value);
+    if (Array.isArray(value)) return `[${value.map(stableJson).join(",")}]`;
+    return `{${Object.keys(value).sort().map((key) => `${JSON.stringify(key)}:${stableJson(value[key])}`).join(",")}}`;
+  };
+  const attemptId = "packed-worker-probe";
+  const workerProbe = path.join(workspace, attemptId);
+  fs.mkdirSync(workerProbe, { recursive: true });
+  const request = {
+    protocolVersion: 1,
+    attemptId,
+    cwd: repoRoot,
+    prompt: "packed worker smoke probe",
+    model: "packed-probe/model",
+    thinkingLevel: "minimal",
+  };
+  request.requestHash = createHash("sha256").update(stableJson(request), "utf8").digest("hex");
+  fs.writeFileSync(path.join(workerProbe, "request.json"), `${JSON.stringify(request)}\n`);
+  fs.writeFileSync(path.join(workerProbe, "lock"), "{}\n");
+  const piStub = path.join(workspace, "pi-rpc-stub.mjs");
+  fs.writeFileSync(piStub, [
+    "#!/usr/bin/env node",
+    "process.stdout.write(JSON.stringify({type: 'message_update', assistantMessageEvent: {type: 'text_delta', delta: '<approved/>'}}) + '\\n');",
+    "process.stdout.write(JSON.stringify({type: 'agent_settled'}) + '\\n');",
+  ].join("\n"));
+  fs.chmodSync(piStub, 0o755);
+  const workerPath = path.join(installedPackage, "scripts/goal-auditor-worker.mjs");
+  // The worker's bounded process-tree cleanup enumerates its own process
+  // group. Keep this probe in a detached group so a direct smoke invocation
+  // cannot signal the release gate's parent shell while terminating its RPC
+  // stub; the production launcher already supplies the same isolation.
+  execFileSync(process.execPath, [workerPath, "--job-dir", workerProbe], {
+    cwd: installedPackage,
+    detached: true,
+    env: { ...process.env, GLLA_PI_BINARY: piStub, GLLA_AUDITOR_STALL_MS: "1000", GLLA_AUDITOR_EOF_EXIT_GRACE_MS: "100" },
+    encoding: "utf8",
+    timeout: 15_000,
+    stdio: ["ignore", "pipe", "pipe"],
+  });
+  const workerResult = JSON.parse(fs.readFileSync(path.join(workerProbe, "result.json"), "utf8"));
+  if (workerResult.ok !== true || workerResult.output !== "<approved/>") throw new Error("packed worker did not complete its RPC probe");
+  console.log("OK: packed launcher loaded and worker completed its bounded RPC probe");
+
   // Audit 2026-09-13: presence is not loadability — run the packed skill
   // through Pi's own loader against the INSTALLED tree (the source-tree
   // check in release-contract.test.ts cannot catch tarball-only defects).