pi-goal-list-loop-audit 0.38.68 → 0.38.70

package/CHANGELOG.md

@@ -1,5 +1,33 @@
 # Changelog
 
+## 0.38.70 — Paused action cards lead with the action (2026-09-20)
+
+- Paused cards render lifecycle/next, banner, reason, and suggested action before tally, provenance, and judgment, so Pi core tail truncation cuts history instead of the instruction (field 20260920_152744).
+- Judgment rides collapsed on action cards (header + selection; full plaques stay in `/goal status`).
+
+## 0.38.69 — About and README refresh (2026-09-20)
+
+- Refined npm about line and README intro: tighter mission control wording, no em dashes.
+- README range wording uses plain "to" (0 to 10, 1 to 10).
+
+### Antigravity auto-continue port (survey 2026-09-19)
+
+- Mid-run interruption budget (`decisionPauseBudget`): decision pauses past
+  budget auto-default to the recommended option and ledger
+  `decision_budget_auto_default` instead of stalling mid-run.
+- Quota sleep-until-reset: quota-class failures with an explicit upstream
+  hint sleep until reset (5h cap; 5s eager first retry preserved); quota
+  waits never park at the 24h horizon; background primary probe re-arms at
+  reset while fallback serves.
+- Completion-claim evidence-density lint: zero path:line tokens AND zero
+  gate rows rides a ledgered NOTE annotation (claim still audits); every
+  terminal path already ends with the archive record pointer.
+- Per-repo pitfall registry: `.pi-glla/pitfalls.md` (absent stays absent)
+  rides the continuation prompt under REPO PITFALLS, ledgered once per goal.
+- Objection-attached retries: every disapproval extracts durable TODOs via
+  `durableObjectionsForDisapproval` (aggressive keeps only cap/no-progress
+  behaviors); two pre-existing source-shape pins revised to the new shape.
+
 ## 0.38.68 — Relentless auto-continue: heat-routed exhaustion, quota retries, truthful recovering (2026-09-19)
 
 ### Length-exhaustion wedge fixed at the root: heat, not budget (field 162348)

package/README.md

@@ -4,20 +4,20 @@
   <img src="media/glla2.png" alt="GLLA mission control" width="960">
 </p>
 
-> **Long-running, high-leverage autonomy for pi.**
+> **Long running, high leverage autonomy for pi.**
 >
 > Give pi a meaningful outcome. GLLA helps it research, plan, execute,
 > recover, and prove the result over hours or days instead of treating one
 > chat turn as the whole job.
 
 `pi-goal-list-loop-audit` (GLLA) is mission control for autonomous work in
-[pi](https://github.com/badlogic/pi-mono). It is for the work that is too broad,
+[pi](https://github.com/badlogic/pi-mono). It fits work that is too broad,
 too long, or too important to leave to a single uninterrupted prompt:
 repo-wide changes, migrations, audits, research, documentation overhauls,
 large refactors, and continuous improvement.
 
-GLLA does not promise that an agent can never make a mistake. It makes the
-agent's work **more effective, durable, recoverable, and difficult to declare
+GLLA does not promise that an agent never makes a mistake. It makes the
+agent's work **more effective, durable, recoverable, and hard to declare
 finished without evidence**:
 
 - You state the outcome and what “done” means.
@@ -30,7 +30,7 @@ finished without evidence**:
 - A separate detached auditor checks the saved completion claim before GLLA
   accepts it.
 
-The aim is not “run forever.” The aim is **more useful work per unit of
+The aim is not "run forever." The aim is **more useful work per unit of
 attention, with event-driven progress instead of guessed-duration waiting, and
 better evidence at the end**. See `docs/DESIGN-long-running-supervision.md` for
 the long-running policy.
@@ -398,7 +398,7 @@ proof of a quota or billing state.
 
 - automatic retries are bounded and visible; a BUSY/no-stream turn is parked
   and re-dispatched within the configurable **Zero-stream retries** budget
-  (default 3, range 0–10), then requires explicit resume;
+  (default 3, range 0 to 10), then requires explicit resume;
 - `/goal resume`, `/list resume`, and `/loop resume` are explicit recovery
   paths;
 - a user abort means stop, not “try again behind my back”;
@@ -431,7 +431,7 @@ Open `/glla` for the settings table. The most important choices are:
 - **Subagent hang escalation:** warning-only at `0`, or one child-specific
   action after a confirmed frozen interval;
 - **Zero-stream retries:** automatic GLLA recovery attempts after a busy,
-  stream-silent Pi turn; `0` keeps recovery manual and `1–10` bounds repeats;
+  stream-silent Pi turn; `0` keeps recovery manual and `1 to 10` bounds repeats;
 - **Audit cap and retry cadence:** bounds for repeated objections and
   infrastructure recovery.
 

package/docs/INDEX.md

@@ -16,7 +16,7 @@ Policy contracts and recent changes live in the `audit/` directory of the
   failback; v0.35.9 hardened cross-version npm tarball checks; v0.35.10
   handles multi-entry npm dry-run reports; v0.35.11 accepts both npm report
   shapes; v0.35.12 supports npm 12's keyed pack reports; v0.35.13 fixes stale-API recovery loops.
-  v0.35.14–v0.38.68 continue through the supervisor freeze (`/glla pause`),
+  v0.35.14–v0.38.70 continue through the supervisor freeze (`/glla pause`),
   load hold, auditor picker parity, Windows launch fix, zombie-watchdog
   subagent carve-out, due-wait backstop, the `/glla agents` visibility panel,
   durable state-root selection, blank-until-resume auditor context, frozen

package/docs/SETTINGS.md

@@ -64,6 +64,7 @@ copies are ignored (the recovery runtime reads the global file):
 | `wedgeAlertMinutes` | unset (30, or off while aggressive mode is on — the default) | Busy-but-silent minutes before the wedge alert; `0` = off. The menu shows the effective value. |
 | `autoResume` | `false` | Restored goals/loops/lists auto-resume in fresh sessions. Global-only. |
 | `decisionPopup` | `true` | Decision pauses pop the picker (`false` = widget card only). |
+| `decisionPauseBudget` | unset (unlimited) | Max agent-authored decision pauses per goal before auto-default: the (N+1)-th adopts the recommended option as a logged assumption without pausing. `0` = relentless from the first decision. |
 | `carryover` | `"pause"` | Stale carryover on new activation: `"pause"` / `"clear"` / `"resume"`. |
 | `autoAcceptDrafts` | `false` | Drafts activate without the Confirm dialog (unattended rigs). |
 | `auditCap` | `5` (10 aggressive) | Pause after N consecutive auditor disapprovals (`0` = unlimited). |

package/extensions/completion-summary.ts

@@ -1,5 +1,5 @@
 import { execFileSync } from "node:child_process";
-import type { FindingGroup, GateRow, Goal, Status } from "./goal-loop-core.js";
+import { sanitizeDisplayText, type FindingGroup, type GateRow, type Goal, type Status } from "./goal-loop-core.js";
 import { fmtElapsed, truncateCells } from "./goal-loop-display.js";
 
 /**
@@ -180,9 +180,10 @@ export interface HumanCompletionBrief {
  * the durable archive keeps the full text. Falls back to the original
  * when stripping would empty the value. */
 export function chatSafeDetailValue(value: string): string {
+  const safeValue = sanitizeDisplayText(value);
   // v0.38.45 audit: loop the innermost-group strip to a fixpoint
   // (bounded) — a single pass left nested husks like "(log )" behind.
-  let withoutGroups = stripMachineGroups(value);
+  let withoutGroups = stripMachineGroups(safeValue);
   const stripped = withoutGroups
     .replace(/(?:\/var)?\/tmp\/\S+/g, "")
     .replace(/\btarballs?\s+\S+\.tgz\b/gi, "")
@@ -190,7 +191,7 @@ export function chatSafeDetailValue(value: string): string {
     .replace(/\(\s*\)/g, "")
     .replace(/\s{2,}/g, " ")
     .trim();
-  return stripped || value;
+  return stripped || safeValue;
 }
 
 /** The human briefing: outcome first in its own words, then only the
@@ -384,7 +385,7 @@ function stripMachineTokens(line: string): string {
 export function structuredSummaryLines(summary: string | undefined, label = "Outcome:"): string[] | null {
   const raw = rawLabelValue(summary ?? "", label);
   if (!raw || !isSectionStructured(raw)) return null;
-  const lines = raw.split("\n").map(stripMachineTokens);
+  const lines = raw.split("\n").map((line) => stripMachineTokens(sanitizeDisplayText(line)));
   while (lines.length > 0 && !(lines[0] ?? "").trim()) lines.shift();
   while (lines.length > 0 && !(lines[lines.length - 1] ?? "").trim()) lines.pop();
   let text = lines.join("\n");
@@ -416,7 +417,7 @@ export interface RichTerminalParts {
 }
 
 function escapeTableCell(value: string): string {
-  return value.replace(/\|/g, "\\|").replace(/\s+/g, " ").trim();
+  return sanitizeDisplayText(value).replace(/\|/g, "\\|").replace(/\s+/g, " ").trim();
 }
 
 function testsRowStatus(value: string): string {
@@ -470,9 +471,10 @@ function auditRowStatus(history: Goal["auditHistory"]): string {
 
 /** Split a stale-filtered `Label: value` detail into a bold lead + body. */
 function leadBody(detail: string): { lead: string; body: string } {
-  const separator = detail.indexOf(":");
-  if (separator < 0) return { lead: "Note", body: detail };
-  return { lead: detail.slice(0, separator).trim() || "Note", body: detail.slice(separator + 1).trim() };
+  const safeDetail = sanitizeDisplayText(detail);
+  const separator = safeDetail.indexOf(":");
+  if (separator < 0) return { lead: "Note", body: safeDetail };
+  return { lead: safeDetail.slice(0, separator).trim() || "Note", body: safeDetail.slice(separator + 1).trim() };
 }
 
 /**
@@ -487,7 +489,7 @@ const EVIDENCE_TOKEN_PATTERN = /(?<![/~+\w])[\w.+][\w.+/-]*\.[A-Za-z0-9]{1,8}:\d
 
 export function extractEvidenceTokens(text: string): { text: string; evidence: string[] } {
   const evidence: string[] = [];
-  const stripped = text
+  const stripped = sanitizeDisplayText(text)
     .replace(EVIDENCE_TOKEN_PATTERN, (match) => {
       if (evidence.length < RICH_EVIDENCE_TOKENS_PER_FINDING && !evidence.includes(match)) evidence.push(match);
       // The token often rides in parentheses — move the wrapper too, so
@@ -501,6 +503,29 @@ export function extractEvidenceTokens(text: string): { text: string; evidence: s
   return { text: stripped, evidence };
 }
 
+/**
+ * v0.38.69 (Antigravity port): completion-claim evidence-density lint.
+ * A walkthrough always ships areas + counts; GLLA richness rode optional
+ * agent params, so a flat six-label claim with zero path:line tokens and
+ * zero gate rows still passed. Returns a NOTE annotation when the claim
+ * carries no verifiable pointer at all (no evidence tokens across the
+ * summary and every group finding, and no gate rows) — the claim still
+ * audits, but the terminal render falls back to recorded facts. Tokens in
+ * finding groups count; gate rows count as density without tokens.
+ */
+export function completionSummaryDensityNote(
+  summary: string | undefined,
+  groups?: FindingGroup[],
+  gates?: GateRow[],
+): string | undefined {
+  if (!summary?.trim()) return undefined;
+  const pool = [summary, ...(groups ?? []).flatMap((group) => group.findings ?? [])].join("\n");
+  const { evidence } = extractEvidenceTokens(pool);
+  if (evidence.length > 0) return undefined;
+  if ((gates ?? []).length > 0) return undefined;
+  return "low evidence density: no path:line evidence tokens and no verification gate rows — add file:line pointers (e.g. extensions/goal-recovery.ts:847) or a gateRows inventory so the terminal render is verifiable";
+}
+
 /**
  * v0.38.50: one compact duration line from durable goal state — turns,
  * wall-clock elapsed since creation, and audit count. Only known facts
@@ -509,7 +534,9 @@ export function extractEvidenceTokens(text: string): { text: string; evidence: s
 export function buildDurationLine(goal: Goal, now = Date.now()): string | null {
   const segs: string[] = [];
   const turns = goal.telemetry?.turns;
-  if (typeof turns === "number" && Number.isFinite(turns) && turns >= 0) {
+  // Field 20260918_172705: a zero turns count means untracked telemetry,
+  // not a known fact — omit it while elapsed/audits still render.
+  if (typeof turns === "number" && Number.isFinite(turns) && turns > 0) {
     segs.push(`${turns} turn${turns === 1 ? "" : "s"}`);
   }
   const started = Date.parse(goal.createdAt ?? "");
@@ -519,15 +546,25 @@ export function buildDurationLine(goal: Goal, now = Date.now()): string | null {
   return segs.length > 0 ? `\u2014 ${segs.join(" \u00b7 ")}` : null;
 }
 
-/** Partition informing details into findings / Tests / next buckets. */
+/** Partition informing details into findings / Tests / next buckets.
+ * Field 20260918_172705: exact-duplicate lines collapse to one per bucket
+ * (repeated claim details rendered as doubled rows). Near-duplicates with
+ * different wording still render — that prose belongs to the claim. */
 export function partitionRichDetails(details: string[]): { findings: string[]; tests: string[]; next: string[] } {
+  const seen = new Set<string>();
+  const push = (bucket: string[], detail: string) => {
+    const key = detail.trim();
+    if (seen.has(key)) return;
+    seen.add(key);
+    bucket.push(detail);
+  };
   const findings: string[] = [];
   const tests: string[] = [];
   const next: string[] = [];
   for (const detail of details) {
-    if (/^\s*Tests\s*:/i.test(detail)) tests.push(detail);
-    else if (/^\s*(Next|Unresolved|Left out)\s*:/i.test(detail)) next.push(detail);
-    else findings.push(detail);
+    if (/^\s*Tests\s*:/i.test(detail)) push(tests, detail);
+    else if (/^\s*(Next|Unresolved|Left out)\s*:/i.test(detail)) push(next, detail);
+    else push(findings, detail);
   }
   return { findings, tests, next };
 }
@@ -538,15 +575,17 @@ export function partitionRichDetails(details: string[]): { findings: string[]; t
  * `## Done — outcome` shape stays, so direct unit callers are unaffected.
  */
 export function requestEchoHeadline(kind: "Done" | "Aborted", objective: string | undefined, outcome: string): string {
-  const echo = objective?.trim() ? clipSummaryValue(objective.trim(), RICH_OBJECTIVE_ECHO_CHARS) : null;
-  return echo ? `## ${kind}: ${echo} \u2014 ${outcome}` : `## ${kind} \u2014 ${outcome}`;
+  const safeObjective = objective ? sanitizeDisplayText(objective) : "";
+  const safeOutcome = sanitizeDisplayText(outcome);
+  const echo = safeObjective.trim() ? clipSummaryValue(safeObjective.trim(), RICH_OBJECTIVE_ECHO_CHARS) : null;
+  return echo ? `## ${kind}: ${echo} \u2014 ${safeOutcome}` : `## ${kind} \u2014 ${safeOutcome}`;
 }
 
 /** Chat-only projection: keep explanations and counts, not command/hash receipts.
  * Repository-only findings are filtered separately; useful implementation
  * references in substantive explanations are not themselves bookkeeping. */
 function chatNarrative(value: string): string {
-  return stripMachineGroups(chatSafeDetailValue(value)
+  return stripMachineGroups(chatSafeDetailValue(sanitizeDisplayText(value))
     .replace(/\b(?:fixed in|commit|HEAD(?: at)?|built from)\s+`?[a-f0-9]{7,64}`?/gi, "")
     .replace(/\b(?=[a-f0-9]*[a-f])(?=[a-f0-9]*\d)[a-f0-9]{7,64}\b/gi, "")
     .replace(/`(?:bun|npm|npx|node|git|tsc)\s+[^`]+`/g, "")
@@ -620,9 +659,12 @@ export function buildFinalRepoStateLines(cwd: string): string[] | undefined {
       return undefined;
     }
   };
-  const branch = run(["branch", "--show-current"]);
-  const head = run(["log", "-1", "--format=%h %s"]);
-  const short = run(["status", "--short"]);
+  const branchRaw = run(["branch", "--show-current"]);
+  const headRaw = run(["log", "-1", "--format=%h %s"]);
+  const shortRaw = run(["status", "--short"]);
+  const branch = branchRaw === undefined ? undefined : sanitizeDisplayText(branchRaw);
+  const head = headRaw === undefined ? undefined : sanitizeDisplayText(headRaw);
+  const short = shortRaw === undefined ? undefined : shortRaw.split("\n").map((line) => sanitizeDisplayText(line)).join("\n");
   if (!branch && !head && short === undefined) return undefined;
   const lines = [`Branch ${branch ?? "detached"}${head ? ` @ ${head}` : ""}`];
   if (short === undefined) lines.push("Tree state unreadable");
@@ -660,7 +702,7 @@ export function buildRichTerminalParts(args: {
   chat?: boolean;
 }): RichTerminalParts {
   const { findings, tests, next } = partitionRichDetails(args.details);
-  const outcome = args.outcome;
+  const outcome = sanitizeDisplayText(args.outcome);
   const kind = args.kind ?? "Done";
   const headline = args.chat ? `## ${kind} — ${outcome}` : requestEchoHeadline(kind, args.objective, outcome);
   const auditStatus = auditRowStatus(args.auditHistory);
@@ -676,11 +718,11 @@ export function buildRichTerminalParts(args: {
     findingLines.push("| Area | Finding | Evidence |", "| --- | --- | --- |");
     for (const group of groups) {
       group.findings.forEach((finding, fi) => {
-        const { text, evidence } = extractEvidenceTokens(finding);
+        const { text, evidence } = extractEvidenceTokens(sanitizeDisplayText(finding));
         const { lead, body } = leadBody(text);
         // v0.38.52: test proof rides the Evidence cell (tables have no
         // sub-bullets); cells stay pipe-escaped. v0.38.55: unclipped.
-        const proof = group.tests?.[fi]?.trim();
+        const proof = group.tests?.[fi] ? sanitizeDisplayText(group.tests[fi]).trim() : "";
         const evidenceCell = [evidence.join(", ") || "\u2014", ...(proof ? [`Tests: ${proof}`] : [])].join(" \u00b7 ");
         findingLines.push(
           `| ${escapeTableCell(group.title)} | ${escapeTableCell(`**${lead}** \u2014 ${body}`)} | ${escapeTableCell(evidenceCell)} |`,
@@ -689,12 +731,12 @@ export function buildRichTerminalParts(args: {
     }
   } else if (groups.length > 0) {
     groups.forEach((group, i) => {
-      findingLines.push(`#### ${i + 1}. ${group.title}`);
+      findingLines.push(`#### ${i + 1}. ${sanitizeDisplayText(group.title)}`);
       group.findings.forEach((finding, fi) => {
-        const { lead, body } = leadBody(args.chat ? chatNarrative(extractEvidenceTokens(finding).text) : finding);
+        const { lead, body } = leadBody(args.chat ? chatNarrative(extractEvidenceTokens(finding).text) : sanitizeDisplayText(finding));
         findingLines.push(`- **${lead}** \u2014 ${body}`);
         // v0.38.52: per-finding test proof (shot C) — absent stays absent.
-        const proof = group.tests?.[fi]?.trim();
+        const proof = group.tests?.[fi] ? sanitizeDisplayText(group.tests[fi]).trim() : "";
         if (proof) findingLines.push(`  - Test Results: ${args.chat ? chatNarrative(proof) : proof}`);
       });
     });
@@ -716,22 +758,25 @@ export function buildRichTerminalParts(args: {
   const showCommand = !args.chat && gates.some((row) => row.command?.trim());
   if (gates.length > 0) {
     for (const row of gates) {
-      const derived = testsRowStatus(row.notes ?? "");
-      const notes = args.chat ? chatNarrative(row.notes ?? "") : row.notes?.trim();
-      const command = row.command?.trim() || "\u2014";
+      const safeNotes = row.notes ? sanitizeDisplayText(row.notes).trim() : "";
+      const derived = testsRowStatus(safeNotes);
+      const notes = args.chat ? chatNarrative(safeNotes) : safeNotes;
+      const command = row.command ? sanitizeDisplayText(row.command).trim() : "\u2014";
+      const gate = sanitizeDisplayText(row.gate);
+      const scope = row.scope ? sanitizeDisplayText(row.scope).trim() : "\u2014";
       tableRows.push(showCommand
-        ? `| ${escapeTableCell(row.gate)} | ${escapeTableCell(command)} | ${escapeTableCell(row.scope?.trim() || "\u2014")} | ${derived} | ${escapeTableCell(notes || "\u2014")} |`
-        : `| ${escapeTableCell(row.gate)} | ${escapeTableCell(row.scope?.trim() || "\u2014")} | ${derived} | ${escapeTableCell(notes || "\u2014")} |`);
+        ? `| ${escapeTableCell(gate)} | ${escapeTableCell(command)} | ${escapeTableCell(scope)} | ${derived} | ${escapeTableCell(notes || "\u2014")} |`
+        : `| ${escapeTableCell(gate)} | ${escapeTableCell(scope)} | ${derived} | ${escapeTableCell(notes || "\u2014")} |`);
     }
   } else {
     for (const detail of tests) {
       const { body } = leadBody(detail);
       const status = testsRowStatus(body);
-      tableRows.push(`| Tests | ${status} | ${escapeTableCell(args.chat ? chatNarrative(body) : body)} |`);
+      tableRows.push(`| Tests | ${status} | ${escapeTableCell(args.chat ? chatNarrative(body) : sanitizeDisplayText(body))} |`);
     }
   }
   if (!args.chat && auditStatus !== "NO VERDICT") {
-    const auditBody = args.countsLine.replace(/^\u2014\s*/, "").replace(/\.\s*$/, "");
+    const auditBody = sanitizeDisplayText(args.countsLine).replace(/^\u2014\s*/, "").replace(/\.\s*$/, "");
     // v0.38.55 audit: the Audit row's Scope names the row kind — the old
     // shape duplicated the counts text in Scope and Notes.
     if (gates.length > 0) {
@@ -763,8 +808,8 @@ export function buildRichTerminalParts(args: {
     findingLines,
     tableLines,
     nextLines,
-    repoLines: args.chat ? [] : args.repoState ?? [],
-    summaryLines: args.summaryLines ?? [],
+    repoLines: args.chat ? [] : (args.repoState ?? []).map((line) => sanitizeDisplayText(line)),
+    summaryLines: (args.summaryLines ?? []).map((line) => sanitizeDisplayText(line)),
   };
 }
 
@@ -776,28 +821,30 @@ export function buildRichTerminalParts(args: {
  * final repository state closes it — findings, verification, Next,
  * repo state, in that order. */
 export function composeRichTerminalLines(parts: RichTerminalParts): string[] {
-  const lines = [parts.banner ?? parts.headline, ""];
-  if (parts.headline !== lines[0]) lines.push(parts.headline, "");
-  if (parts.durationLine) lines.push(parts.durationLine, "");
+  const banner = sanitizeDisplayText(parts.banner ?? parts.headline);
+  const headline = sanitizeDisplayText(parts.headline);
+  const lines = [banner, ""];
+  if (headline !== lines[0]) lines.push(headline, "");
+  if (parts.durationLine) lines.push(sanitizeDisplayText(parts.durationLine), "");
   // Structured-long (field 2026-09-16): the full Outcome body rides its
   // own section between the headline and the findings — findings-first
   // order is preserved (findings, verification, Next keep their relative
   // order), the headline echo stays short, and the one-action Next rule
   // is untouched.
   if (parts.summaryLines.length > 0) {
-    lines.push("### Summary", ...parts.summaryLines, "");
+    lines.push("### Summary", ...parts.summaryLines.map((line) => sanitizeDisplayText(line)), "");
   }
   if (parts.findingLines.length > 0) {
-    lines.push("### Key Findings & Remediation", ...parts.findingLines, "");
+    lines.push("### Key Findings & Remediation", ...parts.findingLines.map((line) => sanitizeDisplayText(line)), "");
   }
   if (parts.tableLines.length > 0) {
-    lines.push("### Verification Summary", ...parts.tableLines, "");
+    lines.push("### Verification Summary", ...parts.tableLines.map((line) => sanitizeDisplayText(line)), "");
   }
   if (parts.nextLines.length > 0) {
-    lines.push("### Next", ...parts.nextLines, "");
+    lines.push("### Next", ...parts.nextLines.map((line) => sanitizeDisplayText(line)), "");
   }
   if (parts.repoLines.length > 0) {
-    lines.push("### Final Repository State", ...parts.repoLines.map((line) => `- ${line}`), "");
+    lines.push("### Final Repository State", ...parts.repoLines.map((line) => `- ${sanitizeDisplayText(line)}`), "");
   }
   return lines;
 }
@@ -889,7 +936,7 @@ function stripApprovalModel(line: string): string {
   return line.replace(/auditor\s+\S+\s+approved/, "auditor approved");
 }
 function trailerBullet(line: string): string {
-  return `• ${line.replace(/^—\s*/, "")}`;
+  return `• ${sanitizeDisplayText(line).replace(/^—\s*/, "")}`;
 }
 
 /** v0.38.25: the audit-goal counts line — verdict proof ONLY, built from

package/extensions/goal-continuation.ts

@@ -1420,7 +1420,7 @@ export function sendStallEscalation(ctx: ExtensionContext, nudges: number): void
   if (supervisorPaused(state)) return;
   // Audit 2026-09-07 (HIGH): a stall nudge must not resurrect a stood-down
   // chain — same abort-latch reasoning as sendContinuation.
-  if (flags.sessionHandoffPending || flags.initialSessionLoadPending || !flags.extensionApi || flags.extensionApiStale || continuationDispatchStoodDown || pendingContinuationDispatch || flags.abortedStandDown) return;
+  if (flags.sessionHandoffPending || flags.initialSessionLoadPending || !flags.extensionApi || flags.extensionApiStale || flags.staleTerminalDone || flags.zombieStoodDown || continuationDispatchStoodDown || pendingContinuationDispatch || flags.abortedStandDown) return;
   if (!state.goal || !guardGoalBeforeContinuation(ctx, "stall-escalation")) return;
   const remaining = HEARTBEAT_MAX_NUDGES - nudges;
   const text = [
@@ -1464,7 +1464,7 @@ export function sendLengthContinue(ctx: ExtensionContext, consecutive: number):
   if (supervisorPaused(state)) return;
   // Audit 2026-09-07 (HIGH): a length nudge must not resurrect a stood-down
   // chain — same abort-latch reasoning as sendContinuation.
-  if (flags.sessionHandoffPending || flags.initialSessionLoadPending || !flags.extensionApi || flags.extensionApiStale || continuationDispatchStoodDown || pendingContinuationDispatch || flags.abortedStandDown) return;
+  if (flags.sessionHandoffPending || flags.initialSessionLoadPending || !flags.extensionApi || flags.extensionApiStale || flags.staleTerminalDone || flags.zombieStoodDown || continuationDispatchStoodDown || pendingContinuationDispatch || flags.abortedStandDown) return;
   if (state.goal && !guardGoalBeforeContinuation(ctx, "length-continuation")) return;
   // v0.38.66 (PR #55, FOF11): active goals get completion-aware recovery
   // text — a truncated turn must offer closure, not another blind work
@@ -1525,7 +1525,34 @@ export function buildPostCompactResync(briefExcerpt?: string): string {
   return lines.join("\n") + "\n\n";
 }
 
-export function continuationPrompt(goal: Goal, opts: { includeRestartDetail?: boolean } = {}): string {
+/**
+ * v0.38.69 (Antigravity port, 09-04 borrow candidate #1): per-repo pitfall
+ * registry. `.pi-glla/pitfalls.md` holds distilled, answer-agnostic rakes
+ * (never ledger prose — the ledger is forensics, never distilled). Read at
+ * goal start (and re-read when edited mid-goal); absent/blank/unreadable
+ * resolves absent so repos without one render byte-identical prompts.
+ */
+export const PITFALLS_BRIEF_MAX_CHARS = 1500;
+
+export function readPitfallsBrief(cwd: string): string | undefined {
+  let body: string;
+  try {
+    body = fs.readFileSync(path.join(cwd, ".pi-glla", "pitfalls.md"), "utf8");
+  } catch {
+    return undefined;
+  }
+  const trimmed = body.trim();
+  if (!trimmed) return undefined;
+  return trimmed.length > PITFALLS_BRIEF_MAX_CHARS
+    ? trimmed.slice(0, PITFALLS_BRIEF_MAX_CHARS)
+    : trimmed;
+}
+
+/** Goals already ledgered for their pitfalls consult this process — the
+ * ledger records the consult once per goal, never once per turn. */
+const pitfallsLedgeredGoals = new Set<string>();
+
+export function continuationPrompt(goal: Goal, opts: { includeRestartDetail?: boolean; pitfallsBrief?: string } = {}): string {
   // Read the .md file as the template, then substitute {{tokens}}.
   // For v0.1.0 we inline-substitute so we don't need fs at runtime.
   const next = findNextPendingTask(goal.taskList?.tasks ?? []);
@@ -1583,6 +1610,20 @@ export function continuationPrompt(goal: Goal, opts: { includeRestartDetail?: bo
   if (loadSettings(settingsCwd).visionAssist !== false) {
     directives.push(VISION_ASSIST_GUIDANCE);
   }
+  // v0.38.69 (Antigravity port): the repo pitfall registry rides the
+  // continuation prompt — consulted at goal start, re-read when edited.
+  // Explicit opts win (tests); otherwise the repo file resolves, absent
+  // keeping the prompt byte-identical for repos without one.
+  const pitfallsBrief = opts.pitfallsBrief ?? readPitfallsBrief(settingsCwd);
+  if (pitfallsBrief?.trim()) {
+    directives.push(
+      `## REPO PITFALLS (distilled — consult before acting)\n\nThese rakes already caught this repo. Check your plan against them before the first tool call and before every risky step:\n\n${pitfallsBrief.trim()}`,
+    );
+    if (!pitfallsLedgeredGoals.has(goal.id)) {
+      pitfallsLedgeredGoals.add(goal.id);
+      appendLedger(settingsCwd, "pitfalls_consulted", { goalId: goal.id });
+    }
+  }
   if (effSettings.aggressiveMode && isFullAuditObjective(goal.objective)) {
     directives.push(
       "## FULL-AUDIT MODE (aggressiveMode + survey objective)\n\nThis objective is a survey, not a single fix. Spawn 3+ `scout` subagents NOW — one per subsystem, in a single message so they run in parallel — synthesize their findings, and call `propose_task_list` with the result. Do not start fixing before the task list exists.",

package/extensions/goal-loop-core.ts

@@ -656,6 +656,15 @@ export interface Goal {
   pauseOptions?: string[];
   /** v0.28.22: 1-based index into pauseOptions the agent recommends. */
   pauseRecommended?: number;
+  /** v0.38.69 (Antigravity port): mid-run decision-pause accounting — every
+   * agent-authored kind="decision" pause increments this, in-budget or
+   * not, so the interruption budget has a durable counter across reloads. */
+  midRunDecisionCount?: number;
+  /** v0.38.69 (Antigravity port): decisions auto-resolved to the
+   * recommended default when the budget was exhausted — the assumption
+   * the agent must carry into its completion recap's Left out. Bounded
+   * to the trailing 20. */
+  autoDefaultLog?: Array<{ at: string; reason: string; chosen: string; options: string[] }>;
   /** v0.28.22: ISO time a wait-pause becomes resumable (countdown shown). */
   pauseResumeAt?: string;
   /** v0.35.28 (issue #16): set when glla AUTO-resumed a lapsed wait — the
@@ -1120,6 +1129,11 @@ export interface MainModelRecovery {
   retryAt?: string;
   /** Next preferred-primary health probe while a fallback is serving. */
   primaryProbeAt?: string;
+  /** v0.38.69 (Antigravity port): absolute reset of the quota-walled
+   * primary, stamped when the episode failed over with an explicit
+   * upstream reset hint. While a fallback serves, the background primary
+   * probe fires at this reset instead of the generic probe cadence. */
+  primaryResetAt?: string;
   /** A preferred-primary switch was accepted and awaits one supervised turn. */
   primaryProbeInFlight?: boolean;
   /** Number of completed recovery waits; drives the bounded per-attempt exponential cadence. */
@@ -1228,6 +1242,7 @@ export function sanitizeMainModelRecovery(value: unknown): MainModelRecovery | u
     ...(Array.isArray(raw.recoveryNoticeKeys) ? { recoveryNoticeKeys: raw.recoveryNoticeKeys.filter((key): key is string => typeof key === "string").slice(-16).map((key) => key.slice(0, 300)) } : {}),
     ...(date(raw.retryAt) ? { retryAt: date(raw.retryAt) } : {}),
     ...(date(raw.primaryProbeAt) ? { primaryProbeAt: date(raw.primaryProbeAt) } : {}),
+    ...(date(raw.primaryResetAt) ? { primaryResetAt: date(raw.primaryResetAt) } : {}),
     ...(raw.primaryProbeInFlight === true ? { primaryProbeInFlight: true } : {}),
     ...(date(raw.firstFailureAt) ? { firstFailureAt: date(raw.firstFailureAt) } : {}),
     ...(date(raw.autoRetryUntil) ? { autoRetryUntil: date(raw.autoRetryUntil) } : {}),
@@ -3626,6 +3641,21 @@ export function extractPendingTasks(report: string, cap = 5): string[] {
   return out;
 }
 
+/**
+ * v0.38.69 (Antigravity port): objection-attached retries. Every
+ * disapproval — aggressive or not — becomes a durable TODO projection:
+ * extracted objection bullets, or a single review-the-report TODO when
+ * nothing extractable survives. Never an empty list: the retry argues the
+ * objection, not generic effort. The aggressive gate keeps only the
+ * cap-keep-going / no-progress-stop behaviors, never the TODOs.
+ */
+export function durableObjectionsForDisapproval(report: string, statusCommand = "/goal status"): string[] {
+  const extracted = extractPendingTasks(report, 5);
+  return extracted.length > 0
+    ? extracted
+    : [`Review the latest auditor disapproval in ${statusCommand}.`];
+}
+
 /** Contract item 23: is the auditor's IMPOSSIBLE reason about the WHOLE
  * goal or only part of it? Default "full" (safe — keeps the pause);
  * partial only on explicit subset language. */

package/extensions/goal-loop-display.ts

@@ -1112,6 +1112,21 @@ function pausedNextTransition(g: Goal, state: State, now: number): string {
   }
 }
 
+/** v0.38.70 (field 20260920_152744): close a paused action card with its
+ * deferred history. The pause body already ended on a `└─` closer; reopen
+ * it to `├─` and hang the tally/provenance/collapsed-judgment rows after
+ * the action, closing on the last history row. Empty history is a no-op,
+ * so cards with nothing deferred keep their exact shape. */
+function closePausedWithHistory(lines: string[], history: string[], theme?: DisplayTheme): string[] {
+  if (history.length === 0) return lines;
+  const tail = lines[lines.length - 1];
+  if (tail !== undefined) lines[lines.length - 1] = tail.replace(/^└─/, "├─");
+  history.forEach((h, i) => {
+    lines.push(`${i === history.length - 1 ? "└─" : "├─"} ${paint(theme, "dim", h)}`);
+  });
+  return lines;
+}
+
 function pausedLifecycleLines(g: Goal, state: State, extras: WidgetExtras | undefined, now: number): [string, string] {
   const queued = state.list?.length ?? 0;
   return [
@@ -1932,9 +1947,20 @@ function goalLines(g: Goal, state: State, audit: AuditDisplayProgress | null | u
   // v0.38.8: durable verdict tally as a first-class card row — the widget
   // is the glance surface, and stored verdicts are the progress evidence
   // when no auditor is live. Silent when history is empty.
+  // v0.38.70 (field 20260920_152744): a paused action card must lead with
+  // the action, not history. Pi core truncates the widget tail (~10 rows),
+  // so judgment plaques above the blocked banner pushed the suggested action
+  // below the cut — "... (widget truncated)" with no action visible.
+  // Tally, provenance, and judgment ride AFTER the pause closer instead;
+  // judgment rides collapsed (header + selection; full plaques stay in
+  // /goal status). Interrupted/attention cards keep the existing order.
+  const deferHistory = g.status === "paused" && !!g.pauseReason && !interrupted && !attention;
+  const deferredHistory: string[] = [];
   const headTally = formatVerdictTallySegment(auditorVerdictTally(g.auditHistory, now), now);
   if (headTally) {
-    lines.push(`├─ ${paint(theme, "dim", `audits: ${truncate(headTally, Math.max(20, (width ?? 80) - 12))}`)}`);
+    const tallyRow = `audits: ${truncate(headTally, Math.max(20, (width ?? 80) - 12))}`;
+    if (deferHistory) deferredHistory.push(tallyRow);
+    else lines.push(`├─ ${paint(theme, "dim", tallyRow)}`);
   }
   if (g.repairTarget) {
     lines.push(`├─ ${paint(theme, "warning", `REPLAN REQUIRED · original target: ${truncate(g.repairTarget.objective.replace(/\s+/g, " "), Math.max(30, (width ?? 80) - 28))}`)}`);
@@ -1967,12 +1993,22 @@ function goalLines(g: Goal, state: State, audit: AuditDisplayProgress | null | u
     ? []
     : modelProvenanceLines(extras?.modelProvenance, width);
   const provenanceStart = lines.length;
-  provenance.forEach((line, i) => {
-    lines.push(`${i === 0 ? "├─" : "│ "} ${paint(theme, "dim", line)}`);
-  });
+  if (deferHistory) {
+    provenance.forEach((line) => deferredHistory.push(line));
+  } else {
+    provenance.forEach((line, i) => {
+      lines.push(`${i === 0 ? "├─" : "│ "} ${paint(theme, "dim", line)}`);
+    });
+  }
   if (extras?.durableDeferRecommendation) {
     const judgment = buildDurableDeferDecisionLines(extras.durableDeferRecommendation, width);
-    judgment.forEach((line) => lines.push(`├─ ${paint(theme, "dim", line)}`));
+    // Collapsed on action cards: header + selection only. Plaque bodies
+    // stay in /goal status; the glance card must fit the action.
+    const collapsed = deferHistory && judgment.length > 2
+      ? [judgment[0]!, judgment[judgment.length - 1]!]
+      : judgment;
+    if (deferHistory) deferredHistory.push(...collapsed);
+    else judgment.forEach((line) => lines.push(`├─ ${paint(theme, "dim", line)}`));
   }
   if (interrupted) {
     const resumeCmd = isList ? "/list resume" : "/goal resume";
@@ -2031,7 +2067,7 @@ function goalLines(g: Goal, state: State, audit: AuditDisplayProgress | null | u
       lines.push(`├─ ${paint(theme, "dim", lifecycle)}`);
       lines.push(`│  ${paint(theme, "dim", transition)}`);
       lines.push(`└─ ${paint(theme, "warning", sanitizeProviderDisplayText(g.pauseSuggestedAction ?? `The claim is safe; ${isList ? "/list resume" : "/goal resume"} starts exactly one fresh auditor.`))}`);
-      return lines;
+      return closePausedWithHistory(lines, deferredHistory, theme);
     }
     const [lifecycle, transition] = pausedLifecycleLines(g, state, extras, now);
     lines.push(`├─ ${paint(theme, "dim", lifecycle)}`);
@@ -2128,7 +2164,7 @@ function goalLines(g: Goal, state: State, audit: AuditDisplayProgress | null | u
       // the card here, closing the previous row as the footer.
       const tail = lines[lines.length - 1];
       if (tail !== undefined) lines[lines.length - 1] = tail.replace(/^├─|^│\s*/, "└─ ");
-      return lines;
+      return closePausedWithHistory(lines, deferredHistory, theme);
     }
     const spent: string[] = [];
     const tokUsed = g.usage?.tokensUsed ?? 0;
@@ -2148,7 +2184,7 @@ function goalLines(g: Goal, state: State, audit: AuditDisplayProgress | null | u
     } else {
       lines.push(`└─ ${paint(theme, "dim", truncate(savedLine, budget))}`);
     }
-    return lines;
+    return closePausedWithHistory(lines, deferredHistory, theme);
   }
   if (attention) {
     const budget = budgetFor(width, 3, 60);