pi-goal-list-loop-audit 0.38.91 → 0.38.95

package/CHANGELOG.md

@@ -1,5 +1,24 @@
 # Changelog
 
+## 0.38.95 — Stop the pause cycles: image-count clamp, ledger dedupe (2026-09-23)
+
+- The payload guard now clamps image blocks per request (default 4, the observed provider limit) as well as bytes — small screenshots fit the byte budget but 400'd on count (field 2026-09-21: `Image count 12 exceeds limit 4`). Oldest-first, keep-recent floor wins on conflict; eviction entries carry the remaining count (audit/PAUSES-2026-09-22.md).
+- Identical `payload_guard_eviction` repeats are deduped per generation (719 identical entries/day in the field) and zombie stand-down logging is latched per silent episode like the abort key (219/day) — first occurrence lands, repeats are silent, changed values re-arm.
+- NOT in this release: a "quiet wait" for single-model chains was implemented then reverted — the cycle-reset probe IS the retry mechanism, and parking it wedged recovery into a never-retry loop (blocked-pause-autoclear caught it). Single-model retries are correct as-is.
+
+## 0.38.94 — Fix continuation spam: delta-only actually fires (2026-09-22)
+
+- Field: 909 identical 28KB continuation prompts in one 8h session (57MB transcript). `firstSend` was computed from the in-flight dispatch latch, which is zero before every fresh send — so every send was "first" and the v0.38.5 marker path never fired. A dedicated per-goal latch now flips only when a full brief dispatches and resets on session rebind: one 28KB brief, then 45-char markers (audit/CONTINUATION-SPAM-2026-09-22.md).
+
+## 0.38.93 — Recovery monitoring: attempts, failing-since, cause (2026-09-22)
+
+- The shared recovery status block (widget, `/goal status`) now carries trajectory facts: `Attempts: N · failing Xh` plus a `Cause: deterministic client error` line when classified — a held 400 with a bare countdown read like a transient that would clear. Transients stay unlabeled; the classifier moved to quota-retry.ts so display shares it without an import cycle.
+
+## 0.38.92 — Deterministic 400s hold; dethroned sessions named (2026-09-22)
+
+- Main-model recovery no longer blind-retries deterministic provider refusals (HTTP 400 — e.g. 12 images against a 4-image model cap, which burned 7.5h of "retrying automatically"). Identical retries cannot succeed, so it holds for manual resume with fix directions (switch model or trim the request) in every mode; model switches retire the old episode's diagnostic so failover still probes (audit/DETERMINISTIC-400-AND-DETHRONED-2026-09-22.md).
+- A session that loses the state-root race is now told exactly that ("owned by another session … not a subagent refusal") instead of being misdiagnosed as a subagent session.
+
 ## 0.38.91 — Tool descriptions enumerate plan/audit/verify/add (2026-09-21)
 
 - `/goal plan`, `/goal audit`, `/goal verify`, `/list plan`, and `/list add` existed but were undiscoverable from the tool descriptions. Both descriptions now enumerate them with one-line roles; a pin keeps the enumerations (audit/POST-090-IMPROVEMENT-SWEEP-2026-09-21.md).

package/docs/INDEX.md

@@ -16,7 +16,7 @@ Policy contracts and recent changes live in the `audit/` directory of the
   failback; v0.35.9 hardened cross-version npm tarball checks; v0.35.10
   handles multi-entry npm dry-run reports; v0.35.11 accepts both npm report
   shapes; v0.35.12 supports npm 12's keyed pack reports; v0.35.13 fixes stale-API recovery loops.
-  v0.35.14–v0.38.91 continue through the supervisor freeze (`/glla pause`),
+  v0.35.14–v0.38.95 continue through the supervisor freeze (`/glla pause`),
   load hold, auditor picker parity, Windows launch fix, zombie-watchdog
   subagent carve-out, due-wait backstop, the `/glla agents` visibility panel,
   durable state-root selection, blank-until-resume auditor context, frozen

package/extensions/goal-continuation.ts

@@ -260,6 +260,23 @@ let continuationScheduledFor: string | null = null;
 
 let lastContinuationSentAt = 0;
 
+/** v0.38.94 (field 2026-09-22: 909 full 28KB sends in one session):
+ * goal id whose initial full brief already landed this session, or null.
+ * Previously `firstSend` was computed as `lastContinuationSentAt === 0`,
+ * but that latch tracks the IN-FLIGHT dispatch — it is zeroed on every
+ * ack/failure/timeout, i.e. before every fresh send — so EVERY send was
+ * "first" and the v0.38.5 delta-only path never fired. This latch flips
+ * only when a full payload actually dispatches, resets on session rebind
+ * (fresh context needs the brief again), and keys on goal id so a new
+ * goal re-teaches once. */
+let continuationInitialFullSentFor: string | null = null;
+
+/** Session-start rebind calls this: a fresh host context never saw the
+ * brief, so the next send for the restored goal goes full again. */
+export function resetContinuationInitialSend(): void {
+  continuationInitialFullSentFor = null;
+}
+
 // Audit 2026-09-07 (MEDIUM): wall-clock of the last genuine user-role
 // message observed via message_start. A user message arriving after a
 // dispatch was sent means the next agent_start/turn_start belongs to the
@@ -1376,7 +1393,7 @@ export function sendContinuation(goalId: string): void {
     // start-proof matching keeps working; fallback agent_start/turn_start
     // needs no prompt at all.
     const goalForSend = state.goal!;
-    const { content, kind } = buildContinuationContent(goalForSend, { resync, firstSend: lastContinuationSentAt === 0 });
+    const { content, kind } = buildContinuationContent(goalForSend, { resync, firstSend: continuationInitialFullSentFor !== goalId });
     flags.extensionApi.sendMessage({
       customType: GOAL_EVENT_ENTRY,
       content,
@@ -1384,6 +1401,9 @@ export function sendContinuation(goalId: string): void {
     }, { triggerTurn: true, deliverAs: "followUp" });
     lastContinuationSentPayload = { content, display: false }; // v0.34.88: verbatim retry payload
     if (!dispatchAccepted(ctx, attempt)) return;
+    // v0.38.94: flip the initial-send latch only once a full payload has
+    // actually dispatched — a failed send must not burn the one full brief.
+    if (kind === "full" || kind === "full+resync") continuationInitialFullSentFor = goalId;
     continuationRearmStreak = 0; continuationRearmSince = 0; // v0.28.5 (E3): an accepted dispatch clears the storm
     appendLedger(ctx.cwd, "goal_continuation_sent", { goalId, attemptId: attempt.id, generation: attempt.generation, kind, payloadChars: content.length, ...(busyBypass ? { busyBypass: true } : {}) });
     // v0.35.37 (audit finding): the welcome-back recovery notice must fire

package/extensions/goal-heartbeat.ts

@@ -178,6 +178,10 @@ let lastWedgeAlertAt = 0;
 // host turn exactly once. The key fences repeated heartbeat ticks and lets a
 // later explicit resume start a fresh, independently bounded attempt.
 let lastZombieAbortKey = "";
+// Field 2026-09-22: the stand-down branch logged on EVERY heartbeat tick
+// (219 zombie_run_stood_down_user_input in a day) while a wait was pending.
+// Latch it per silent episode exactly like the abort key.
+let lastZombieStandDownKey = "";
 let zombieRunSilentMsOverride: number | null = null;
 let zombieRunAbortGraceMsOverride: number | null = null;
 
@@ -328,6 +332,7 @@ export function __testOnlySetZombieRunWindows(silentMs: number | null, abortGrac
   zombieRunAbortGraceMsOverride = abortGraceMs;
   lastZombieAlertAt = 0;
   lastZombieAbortKey = "";
+  lastZombieStandDownKey = "";
 }
 
 /** Test-only reset for the process-global watchdog state. */
@@ -336,6 +341,7 @@ export function __testOnlyResetZombieRunWatchdog(): void {
   zombieRunAbortGraceMsOverride = null;
   lastZombieAlertAt = 0;
   lastZombieAbortKey = "";
+  lastZombieStandDownKey = "";
 }
 
 /** v0.35.17: release the one-shot abort latch when the bounded automatic
@@ -345,6 +351,7 @@ export function __testOnlyResetZombieRunWatchdog(): void {
  * NEVER re-abort — a permanently BUSY-silent session. */
 export function releaseZombieAbortKey(): void {
   lastZombieAbortKey = "";
+  lastZombieStandDownKey = "";
 }
 
 let lastUnansweredAlertAt = 0;
@@ -1392,7 +1399,9 @@ function heartbeatTick(): void {
       isUserInputWaitCall,
     );
     if (subagentWaitInFlight || userInputWaitInFlight) {
-      if (streamSilentMs >= zombieAbortMs && !flags.abortedStandDown) {
+      const standDownKey = `${flags.sessionGeneration}:${state.goal?.id ?? "loop"}:${flags.lastStreamActivityAt}`;
+      if (streamSilentMs >= zombieAbortMs && !flags.abortedStandDown && standDownKey !== lastZombieStandDownKey) {
+        lastZombieStandDownKey = standDownKey;
         appendLedger(
           ctx.cwd,
           subagentWaitInFlight

package/extensions/goal-loop-core.ts

@@ -11,7 +11,7 @@ import * as fs from "node:fs";
 import * as path from "node:path";
 import { createHash } from "node:crypto";
 import { execSync } from "node:child_process";
-import { normalizeProviderErrorText, providerErrorFingerprint, providerErrorPresentation, quotaSignal, sanitizeProviderAuditReport, sanitizeProviderDisplayText, type QuotaSignal } from "./quota-retry.js";
+import { isDeterministicProviderError, normalizeProviderErrorText, providerErrorFingerprint, providerErrorPresentation, quotaSignal, sanitizeProviderAuditReport, sanitizeProviderDisplayText, type QuotaSignal } from "./quota-retry.js";
 import { MAX_AUDITOR_CANDIDATE_REFS, MAX_MAIN_MODEL_FALLBACKS, normalizeBoundedModelRefs } from "./main-model-recovery.js";
 import { resolveGllaStateDir, stateRootPending } from "./glla-state-root.js";
 export { normalizeProviderErrorText, providerErrorFingerprint, providerErrorPresentation, sanitizeProviderAuditReport, sanitizeProviderDisplayText } from "./quota-retry.js";
@@ -1195,7 +1195,18 @@ export interface MainModelRecovery {
 }
 
 /** Compact, truthful status shared by /goal status and /list show. */
-export function formatMainModelRecoveryStatus(recovery: MainModelRecovery | undefined, configuredBackups: string[] = []): string[] {
+/** Compact elapsed for recovery trajectory lines (core has no display
+ * import — display's fmtElapsed stays the renderer). */
+function fmtRecoveryElapsed(ms: number): string {
+  if (!Number.isFinite(ms) || ms < 0) return "?";
+  const mins = Math.floor(ms / 60_000);
+  if (mins < 60) return `${mins}m`;
+  const hours = Math.floor(mins / 60);
+  if (hours < 48) return `${hours}h${mins % 60 ? ` ${mins % 60}m` : ""}`;
+  return `${Math.floor(hours / 24)}d ${hours % 24}h`;
+}
+
+export function formatMainModelRecoveryStatus(recovery: MainModelRecovery | undefined, configuredBackups: string[] = [], nowMs: number = Date.now()): string[] {
   if (!recovery) return [];
   const safeBackups = configuredBackups.filter((ref) => typeof ref === "string" && ref.trim()).slice(0, MAX_MAIN_MODEL_FALLBACKS);
   const chain = [recovery.primary, ...safeBackups];
@@ -1205,6 +1216,20 @@ export function formatMainModelRecoveryStatus(recovery: MainModelRecovery | unde
   const skipped = recovery.skipped?.length
     ? recovery.skipped.map((entry) => `${entry.ref} (${entry.reason})`).join(", ")
     : "none";
+  // v0.38.93: trajectory facts — attempts + failing-since answer "is it
+  // getting better or worse?", which the retry countdown alone cannot.
+  // Durable counters only, never a provider-side guess.
+  const attempts = typeof recovery.attempts === "number" && recovery.attempts > 0 ? recovery.attempts : 0;
+  const firstMs = typeof recovery.firstFailureAt === "string" ? Date.parse(recovery.firstFailureAt) : Number.NaN;
+  const trajectory = attempts > 0 || Number.isFinite(firstMs)
+    ? [`  Attempts: ${attempts}${Number.isFinite(firstMs) ? ` · failing ${fmtRecoveryElapsed(nowMs - firstMs)}` : ""}`]
+    : [];
+  // v0.38.93: name the deterministic class when classified — a held 400
+  // with a countdown reads like a transient that will clear; it won't.
+  // Transients stay unlabeled (cards never guess provider reasons).
+  const cause = isDeterministicProviderError(recovery.providerErrorDiagnostic ?? recovery.reason)
+    ? ["  Cause: deterministic client error — identical retries cannot succeed"]
+    : [];
   const lines = [
     `Main-model recovery: ${currentIndex >= 0 ? `${currentIndex === 0 ? "primary" : `backup ${currentIndex}/${safeBackups.length}`} selected` : "active model selected"}`,
     `  Order: ${chain.join(" → ")}`,
@@ -1212,6 +1237,8 @@ export function formatMainModelRecoveryStatus(recovery: MainModelRecovery | unde
     ...(recovery.pendingModelSwitch ? [`  Pending switch: ${recovery.pendingModelSwitch}`] : []),
     `  Attempted: ${attempted}`,
     `  Skipped: ${skipped}`,
+    ...trajectory,
+    ...cause,
   ];
   if (recovery.retryAt) lines.push(`  Retry at: ${recovery.retryAt}`);
   if (recovery.primaryProbeAt) lines.push(`  Preferred-primary probe at: ${recovery.primaryProbeAt}`);

package/extensions/goal-recovery.ts

@@ -31,6 +31,7 @@ import {
   mainModelFailureDelayMs,
   mainModelPrimaryProbeDelayMs,
   mainModelRetryDelayMs,
+  isDeterministicProviderError,
   isQuotaHorizonExempt,
   quotaResetSleepMs,
   isCompactionInFlightSince,
@@ -800,6 +801,15 @@ export function setMainModelRecoveryPause(ctx: ExtensionContext, recovery: MainM
   };
   const now = Date.now();
   const deadlineMs = normalized.autoRetryUntil ? Date.parse(normalized.autoRetryUntil) : Number.NaN;
+  // v0.38.92: deterministic 400s never schedule — an identical retry cannot
+  // succeed, so the ladder would burn (forever under aggressiveMode) while
+  // promising "retrying automatically". Hold for manual resume with the fix
+  // directions; the user's resume re-probes a CHANGED request. Checked
+  // before the horizon/quota logic so it wins in every mode.
+  if (isDeterministicProviderError(normalized.providerErrorDiagnostic ?? normalized.reason)) {
+    holdMainModelRecovery(ctx, normalized, "the provider refused the request itself (deterministic client error — e.g. too many images for this model). Switch model or trim the request, then resume");
+    return false;
+  }
   const requestedDelayMs = Math.max(1_000, delayMs);
   // v0.38.69 (Antigravity port): quota waits never park at the horizon —
   // a rate-limit/plan-quota wall is transient, so the hold below is
@@ -1438,7 +1448,10 @@ async function probeMainModelRecoveryImpl(ctx: ExtensionContext): Promise<void>
     }
     // The ordered chain has been visited for this recovery cycle. Start a
     // deliberate new cycle by retrying the currently selected model; the
-    // next failure can then walk primary → backup 1 → … again.
+    // next failure can then walk primary → backup 1 → … again. (2026-09-23:
+    // a single-model chain still needs this probe — it IS the retry. An
+    // attempted "quiet wait" here wedged recovery into a park loop that
+    // never retried; blocked-pause-autoclear pins the probe contract.)
     // Audit 2026-09-07 (HIGH, scoped): each new cycle consumes backoff
     // budget (attempts+1, so the next failure's envelope delay grows) and
     // honors the 24h horizon (past the wall the reset holds for manual
@@ -1627,7 +1640,11 @@ export async function recoverMainModelFromSendStorm(ctx: ExtensionContext, kind:
     if (!current) return;
     const recovery = state.mainModelRecovery;
     if (!recovery) return;
-    if (setMainModelRecoveryPause(ctx, { ...recovery, kind: kind === "loop" ? "loop" : "goal", active: current, resumeCurrent: true }, 1_000)) {
+    // v0.38.92: the switch retires the old episode's diagnostic — it
+    // describes the previous model's failure, and a stale deterministic
+    // marker must not hold the fresh model's probe. Reason restarts from
+    // the storm failure that triggered the switch.
+    if (setMainModelRecoveryPause(ctx, { ...recovery, kind: kind === "loop" ? "loop" : "goal", active: current, resumeCurrent: true, reason: mainModelRecoveryReason(failure), providerErrorDiagnostic: undefined }, 1_000)) {
       flags.mainModelAbortForRecovery = true;
       try { ctx.abort(); } catch { /* best effort; recovery guard prevents re-send storms */ }
       scheduleMainModelRecoveryTimer(ctx, 1_000);

package/extensions/loops/goal-activation.ts

@@ -173,6 +173,7 @@ import {
   setContinuationRearmStreak,
   setContinuationRearmSince,
   resetContinuationDispatchState,
+  resetContinuationInitialSend,
   noteUserMessageForDispatch,
   sendTerminalCompletionNotice,
   type ContinuationFlags,
@@ -493,6 +494,11 @@ function clearInBandProviderFailure(): void {
 // session_start, and manual parks — never on starved stops (the wedge
 // persists) so a hot context cannot lap the budget forever.
 let lengthExhaustionEpisodes = 0;
+// Field 2026-09-22: every send re-projects the same bloated history, which
+// logged 719 identical payload_guard_eviction entries in a day. Dedupe by
+// fingerprint — first occurrence lands, identical repeats are silent, and
+// any value change (or generation bump) re-arms.
+let lastPayloadEvictionFingerprint = "";
 /** A manual resume starts a fresh relentless cycle: a user pause between
 an episode-1 wedge and the next one must not make that wedge park one
 cycle early. */
@@ -1426,6 +1432,7 @@ export function registerGoalRuntime(pi: ExtensionAPI): void {
     clearToolActivityState();
     bindSubagentRpcHost(pi.events, sessionGeneration);
     clearDraftingState();
+    resetContinuationInitialSend(); // v0.38.94: fresh host context never saw the brief
     // An auditor belonging to the disposed generation cannot block the fresh
     // session's recovery gate; its finally block is generation-guarded too.
     completionAuditInFlight = false;
@@ -3108,12 +3115,17 @@ async function handleHotLengthExhaustion(
         });
       }
       if (projection.evicted.length > 0) {
-        appendLedger(ctx.cwd, "payload_guard_eviction", {
-          evicted: projection.evicted.length,
-          bytesFreed: projection.totalImageBytes - projection.remainingImageBytes,
-          remainingImageBytes: projection.remainingImageBytes,
-          generation: sessionGeneration,
-        });
+        const evictionFingerprint = `${sessionGeneration}:${projection.evicted.length}:${projection.totalImageBytes - projection.remainingImageBytes}:${projection.remainingImageBytes}:${projection.remainingImageCount}`;
+        if (evictionFingerprint !== lastPayloadEvictionFingerprint) {
+          lastPayloadEvictionFingerprint = evictionFingerprint;
+          appendLedger(ctx.cwd, "payload_guard_eviction", {
+            evicted: projection.evicted.length,
+            bytesFreed: projection.totalImageBytes - projection.remainingImageBytes,
+            remainingImageBytes: projection.remainingImageBytes,
+            remainingImageCount: projection.remainingImageCount,
+            generation: sessionGeneration,
+          });
+        }
       }
       if (checkpointProjection.removedPayloads > 0) {
         appendLedger(ctx.cwd, "context_checkpoint_projection", {

package/extensions/loops/goal-session.ts

@@ -1884,8 +1884,15 @@ function isHostLifecycleSessionStart(event: unknown): boolean {
 
 const FOREIGN_SESSION_TOOL_MESSAGE =
   "This tool changes goal/loop/list state, which only the MAIN session owns — you are running in a subagent session. Report back to the main agent; it owns the goal and can call this tool.";
-const FOREIGN_SESSION_TOOL_MESSAGE_WITH_STATE_ROOT_HINT =
-  `${FOREIGN_SESSION_TOOL_MESSAGE} If you also see the state-root read-only warning, close the other host or switch to sessionDir via /glla settings → State root, then start a fresh session.`;
+/** Refusal when the caller lost the workingDir state-root race (field
+ * 2026-09-21: a dethroned MAIN session got the bare subagent message,
+ * which misdiagnoses — it is not a worker, it lost the root to another
+ * live session). Keeps the v0.35.72 pinned contract (MAIN-owner clause,
+ * "state-root read-only", sessionDir cure) but replaces the false
+ * "subagent session" diagnosis with the dethroned one. Replaces
+ * FOREIGN_SESSION_TOOL_MESSAGE_WITH_STATE_ROOT_HINT. */
+const DETHRONED_SESSION_TOOL_MESSAGE =
+  "This tool changes goal/loop/list state, which only the MAIN session owns — but this is not a subagent refusal: another live session holds this folder's state root, so this session is state-root read-only. Close the other session, start a fresh session here to take the root back (/glla owner inspects the holder), or switch to sessionDir via /glla settings → State root.";
 
 /** Refusal message when a state-mutating tool is called from a subagent session, else null. */
 function foreignToolGuard(execCtx: unknown): string | null {
@@ -1901,9 +1908,10 @@ function foreignToolGuard(execCtx: unknown): string | null {
   if (tryAbsorbHostSuccessor(c, "tool-call")) return null;
   if (isForeignCtx(c)) {
     // v0.35.72: when the cwd is also denied by the workingDir state-root
-    // owner, the two warnings co-occur. Correlate them so "MAIN became
-    // subagent and cannot be cured" has an actionable cure.
-    if (c && processOwnerDeniedCwd === c.cwd) return FOREIGN_SESSION_TOOL_MESSAGE_WITH_STATE_ROOT_HINT;
+    // owner, the two warnings co-occur. v0.38.92: name the dethroned
+    // diagnosis, not the subagent one — the caller is usually a former
+    // main session that lost the root race (field 2026-09-21).
+    if (c && processOwnerDeniedCwd === c.cwd) return DETHRONED_SESSION_TOOL_MESSAGE;
     return FOREIGN_SESSION_TOOL_MESSAGE;
   }
   // Post-park the owner is nulled; the dead-owner record means only the

package/extensions/main-model-recovery.ts

@@ -323,6 +323,10 @@ export function isQuotaHorizonExempt(raw: string | undefined): boolean {
   return signal === "rate-limit" || signal === "plan-quota";
 }
 
+// v0.38.92 classifier lives in quota-retry.ts (shared with the display
+// layer); re-exported here so existing importers keep working.
+export { isDeterministicProviderError } from "./quota-retry.js";
+
 /** v0.38.69 (Antigravity port): sleep-until-reset for quota-class failures
  * with an explicit upstream reset hint. Returns undefined (keep the blind
  * ladder) unless ALL hold: a rate-limit/plan-quota signal, an upstream

package/extensions/payload-guard.ts

@@ -31,6 +31,11 @@ export const DEFAULT_IMAGE_BUDGET_BYTES = 16 * 1024 * 1024;
  * current turn almost always needs the newest visual state. */
 export const DEFAULT_KEEP_RECENT_IMAGES = 2;
 
+/** Max inline image blocks in one outgoing request. Field 2026-09-21: a
+ * provider 400'd `Image count 12 exceeds limit 4 per request` on small
+ * screenshots that fit the byte budget — count is a separate wall. */
+export const DEFAULT_MAX_IMAGES_PER_REQUEST = 4;
+
 export interface ImageBlockLocation {
   messageIndex: number;
   blockIndex: number;
@@ -52,11 +57,16 @@ export interface EvictionResult {
   totalImageBytes: number;
   /** Cumulative image bytes AFTER eviction. */
   remainingImageBytes: number;
+  /** Image blocks BEFORE eviction. */
+  totalImageCount: number;
+  /** Image blocks AFTER eviction. */
+  remainingImageCount: number;
 }
 
 export interface PayloadGuardOptions {
   imageBudgetBytes?: number;
   keepRecentImages?: number;
+  maxImagesPerRequest?: number;
 }
 
 interface ImageBlockLike {
@@ -101,10 +111,12 @@ function evictionPlaceholder(bytes: number): { type: string; text: string } {
 
 /**
  * Project the outgoing message list with cumulative inline-image bytes
- * bounded to `imageBudgetBytes`. Oldest images are evicted first; the most
- * recent `keepRecentImages` images are never evicted (best effort when the
- * budget cannot be met even without them). Returns the input array identity
- * when nothing needs eviction — callers can cheaply detect the no-op.
+ * bounded to `imageBudgetBytes` AND image blocks bounded to
+ * `maxImagesPerRequest`. Oldest images are evicted first; the most recent
+ * `keepRecentImages` images are never evicted (best effort when neither
+ * bound can be met without them — the floor always wins). Returns the input
+ * array identity when nothing needs eviction — callers can cheaply detect
+ * the no-op.
  */
 export function evictStaleImages(
   messages: readonly unknown[],
@@ -116,27 +128,31 @@ export function evictStaleImages(
   const keepRecent = typeof opts.keepRecentImages === "number" && opts.keepRecentImages >= 0
     ? opts.keepRecentImages
     : DEFAULT_KEEP_RECENT_IMAGES;
+  const maxImages = typeof opts.maxImagesPerRequest === "number" && opts.maxImagesPerRequest > 0
+    ? Math.floor(opts.maxImagesPerRequest)
+    : DEFAULT_MAX_IMAGES_PER_REQUEST;
 
   const blocks = collectImageBlocks(messages);
   const totalImageBytes = blocks.reduce((sum, b) => sum + b.bytes, 0);
-  if (totalImageBytes <= budget) {
-    return { messages, evicted: [], totalImageBytes, remainingImageBytes: totalImageBytes };
+  if (totalImageBytes <= budget && blocks.length <= maxImages) {
+    return { messages, evicted: [], totalImageBytes, remainingImageBytes: totalImageBytes, totalImageCount: blocks.length, remainingImageCount: blocks.length };
   }
 
-  // Evict oldest-first; the newest `keepRecent` are exempt. When even the
-  // exempt set exceeds the budget the eviction stops there — best effort,
-  // never a destructive sweep of the current visual state.
+  // Evict oldest-first until BOTH bounds hold; the newest `keepRecent` are
+  // exempt. When even the exempt set breaks a bound the eviction stops
+  // there — best effort, never a destructive sweep of the current visual
+  // state.
   const evict = new Set<ImageBlockLocation>();
   let remaining = totalImageBytes;
   const exempt = blocks.slice(Math.max(0, blocks.length - keepRecent));
   for (const block of blocks) {
-    if (remaining <= budget) break;
+    if (remaining <= budget && blocks.length - evict.size <= maxImages) break;
     if (exempt.includes(block)) continue;
     evict.add(block);
     remaining -= block.bytes;
   }
   if (evict.size === 0) {
-    return { messages, evicted: [], totalImageBytes, remainingImageBytes: totalImageBytes };
+    return { messages, evicted: [], totalImageBytes, remainingImageBytes: totalImageBytes, totalImageCount: blocks.length, remainingImageCount: blocks.length };
   }
 
   // Group evictions per message so each affected message is copied once.
@@ -160,7 +176,7 @@ export function evictStaleImages(
     return { ...(message as object), content: newContent };
   });
 
-  return { messages: projected, evicted: [...byMessage.values()].flat(), totalImageBytes, remainingImageBytes: remaining };
+  return { messages: projected, evicted: [...byMessage.values()].flat(), totalImageBytes, remainingImageBytes: remaining, totalImageCount: blocks.length, remainingImageCount: blocks.length - evict.size };
 }
 
 /**

package/extensions/quota-retry.ts

@@ -317,6 +317,20 @@ export function isBillingError(error: string | undefined): boolean {
   return quotaSignal(error) === "billing";
 }
 
+// v0.38.92 (field 2026-09-21: 12 images vs a 4-image model cap retried
+// 7.5h): a deterministic HTTP 400 client error can never succeed on an
+// identical retry — only a changed request (fewer images, different
+// model, fixed params) can. Match the error-type markers, never a bare
+// "400" (token counts and limits quote 400s constantly). Moved here from
+// main-model-recovery.ts in v0.38.93 so the display layer can share the
+// classifier without an import cycle (it is re-exported there).
+const DETERMINISTIC_CLIENT_ERROR = /badrequesterror|invalid_request_error|"code"\s*:\s*"400"/i;
+
+export function isDeterministicProviderError(raw: string | undefined): boolean {
+  if (typeof raw !== "string" || !raw.trim()) return false;
+  return DETERMINISTIC_CLIENT_ERROR.test(raw);
+}
+
 /** Match recoverable provider rate/plan walls and explicit billing walls.
  * Ambiguous `temporarily unavailable`, ordinary 403s, and generic network
  * failures intentionally return false. */

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "pi-goal-list-loop-audit",
-	"version": "0.38.91",
+	"version": "0.38.95",
 	"description": "Mission control for long running pi work: interview drafted goals, an audited task queue, and metric or audit loops that run for hours. Every completion is rechecked by a detached auditor with raw evidence, while Confirm drafts, decision pauses, and consent gates keep you in charge.",
 	"license": "AGPL-3.0-only",
 	"author": "dracon",