pi-goal-list-loop-audit 0.38.95 → 0.38.97

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## 0.38.97 — pause_goal redirect: park-and-continue for user interruptions (2026-09-23)
+
+- Field: a mid-goal redirect ("can we get to this first") parked via pause_goal, whose abort + "do NOT continue working" stranded the new task until the user nudged. New optional `redirect` param parks the goal WITHOUT ending the turn and orders the redirect worked immediately, goal resumed after; redirect parks ledger distinctly as `pause_goal_redirect`. Plain pauses still abort (audit/PAUSE-REDIRECT-2026-09-23.md).
+
+## 0.38.96 — /glla resume + /loop resume release the load hold before probing (2026-09-23)
+
+- Field: a deterministic-400 manual hold cold-loaded (load hold engaged), then `/glla resume` consumed the manual hold and the goal stayed parked — the fired recovery probe died silently on the `supervisorPaused` gate, which includes `loadHoldAt`. No probe, no timer, stale resume text. `/glla resume` and `/loop resume` now release the cold-load hold at entry like `/goal resume` and agent-resume already do (audit/GLLA-RESUME-LOAD-HOLD-2026-09-23.md). Workaround on 0.38.95: run `/goal resume`.
+
 ## 0.38.95 — Stop the pause cycles: image-count clamp, ledger dedupe (2026-09-23)
 
 - The payload guard now clamps image blocks per request (default 4, the observed provider limit) as well as bytes — small screenshots fit the byte budget but 400'd on count (field 2026-09-21: `Image count 12 exceeds limit 4`). Oldest-first, keep-recent floor wins on conflict; eviction entries carry the remaining count (audit/PAUSES-2026-09-22.md).

package/docs/INDEX.md

@@ -16,7 +16,7 @@ Policy contracts and recent changes live in the `audit/` directory of the
   failback; v0.35.9 hardened cross-version npm tarball checks; v0.35.10
   handles multi-entry npm dry-run reports; v0.35.11 accepts both npm report
   shapes; v0.35.12 supports npm 12's keyed pack reports; v0.35.13 fixes stale-API recovery loops.
-  v0.35.14–v0.38.95 continue through the supervisor freeze (`/glla pause`),
+  v0.35.14–v0.38.97 continue through the supervisor freeze (`/glla pause`),
   load hold, auditor picker parity, Windows launch fix, zombie-watchdog
   subagent carve-out, due-wait backstop, the `/glla agents` visibility panel,
   durable state-root selection, blank-until-resume auditor context, frozen

package/extensions/goal-commands.ts

@@ -2481,6 +2481,16 @@ async function cmdGllaResume(ctx: ExtensionContext): Promise<void> {
     appendLedger(ctx.cwd, "supervisor_resume", { frozenMs });
     ctx.ui.notify(`Supervisor RESUMED after ${fmtElapsed(frozenMs)} — heartbeat re-arms, recovery probes, auto-resume, continuation dispatch, and auditor quiet notifies are live again.`, "info");
   }
+  // v0.38.96 (field 2026-09-23, dracon-utilities): /glla resume carries the
+  // same consent semantics as /goal resume, so it must release the cold-load
+  // hold too — otherwise manuallyResumeMainModelRecovery consumes the manual
+  // hold and its probe dies silently on the supervisorPaused gate (which
+  // includes loadHoldAt): no probe, no timer, goal still parked.
+  if (clearLoadHold(state)) {
+    persistState(ctx);
+    appendLedger(ctx.cwd, "load_hold_released", { via: "glla-resume" });
+    ctx.ui.notify("Load hold released — automation is live again.", "info");
+  }
   if (manuallyResumeMainModelRecovery(ctx)) return;
   if (state.mainModelRecovery?.retryAt || state.mainModelRecovery?.pendingModelSwitch) {
     clearMainModelRecoveryTimer();

package/extensions/goal-loop.ts

@@ -1015,6 +1015,14 @@ async function cmdLoop(args: string, ctx: ExtensionContext): Promise<void> {
 
   if (!sub || sub === "resume") {
     releaseInitialSessionLoadBarrier();
+    // v0.38.96 (field 2026-09-23): same release the held-loop path does
+    // below, but at entry — the recovery branches return before it, and a
+    // manual-resume probe fired under a load hold dies silently on the
+    // supervisorPaused gate (hold consumed, loop still held, nothing armed).
+    if (clearLoadHold(state)) {
+      persistState(ctx);
+      appendLedger(ctx.cwd, "load_hold_released", { via: "loop-resume" });
+    }
     if (state.mainModelRecovery?.manualResumeRequired && state.mainModelRecovery.kind === "loop") {
       manuallyResumeMainModelRecovery(ctx);
       return;

package/extensions/loops/goal-tools.ts

@@ -2276,7 +2276,7 @@ function registerAgentTools(pi: any): void {
   pi.registerTool(defineTool({
     name: "pause_goal",
     label: "Pause goal",
-    description: "Pause the active goal with a reason and suggested action. Use when blocked on user input or unable to make progress. Pausing ABORTS the current turn immediately — after this call, stop; never keep working. When the user must CHOOSE between options, pass kind=\"decision\" with the options list (recommended = 1-based index of the best one) — decision pauses render as a prominent DECISION NEEDED card and pop a picker for the user. Time-gated waits (retry at a specific time) use kind=\"wait\" with resumeAt (ISO). Operational failures use kind=\"error\". Pauses that only wait on a running background subagent — its native completion wakes the goal, no manual action exists — use kind=\"standby\" so the card waits instead of demanding action. VOCABULARY (v0.28.24): decision options and reasons must reference REAL commands only — /goal resume, /goal cancel, /goal tweak \"<new text>\", /list remove N, /list next, /list resume, /loop stop, /loop resume. These all act on the ACTIVE goal/item: there is NO /goal drop and NO command takes a goal id. Never show goal ids to the user — name the thing ('the active goal', 'list item \"<short name>\"'); ids are internal plumbing the user cannot act on.",
+    description: "Pause the active goal with a reason and suggested action. Use when blocked on user input or unable to make progress. Pausing ABORTS the current turn immediately — after this call, stop; never keep working. When the user interrupts with a NEW task ('do X first'), pass redirect=\"<their request>\" instead: the goal parks but the turn CONTINUES so you work X immediately — a plain pause strands the redirect until the user nudges. Never use redirect to dodge a real blocker, decision, or wait. When the user must CHOOSE between options, pass kind=\"decision\" with the options list (recommended = 1-based index of the best one) — decision pauses render as a prominent DECISION NEEDED card and pop a picker for the user. Time-gated waits (retry at a specific time) use kind=\"wait\" with resumeAt (ISO). Operational failures use kind=\"error\". Pauses that only wait on a running background subagent — its native completion wakes the goal, no manual action exists — use kind=\"standby\" so the card waits instead of demanding action. VOCABULARY (v0.28.24): decision options and reasons must reference REAL commands only — /goal resume, /goal cancel, /goal tweak \"<new text>\", /list remove N, /list next, /list resume, /loop stop, /loop resume. These all act on the ACTIVE goal/item: there is NO /goal drop and NO command takes a goal id. Never show goal ids to the user — name the thing ('the active goal', 'list item \"<short name>\"'); ids are internal plumbing the user cannot act on.",
     parameters: Type.Object({
       reason: Type.String({ description: "Why the work is paused" }),
       suggestedAction: Type.Optional(Type.String({ description: "What the user should do next" })),
@@ -2284,13 +2284,14 @@ function registerAgentTools(pi: any): void {
       options: Type.Optional(Type.Array(Type.String(), { description: "For kind=decision: the options the user picks between (one line each)" })),
       recommended: Type.Optional(Type.Number({ description: "For kind=decision: 1-based index of the recommended option" })),
       resumeAt: Type.Optional(Type.String({ description: "For kind=wait: ISO time the pause lifts (countdown is shown)" })),
+      redirect: Type.Optional(Type.String({ description: "User redirect to work IMMEDIATELY in this same turn (quote or summarize the interrupting request). Parks the goal WITHOUT ending the turn; the result orders the redirect worked now and the goal resumed after. Only for genuine user redirects." })),
     }),
     async execute(_id, params, _signal, _onUpdate, execCtx) {
       const foreign1 = foreignToolGuard(execCtx);
       if (foreign1) return { content: [{ type: "text", text: foreign1 }], details: {} };
       const ctx = currentToolContext(execCtx);
       if (!ctx) return staleToolResult();
-      const p = params as { reason: string; suggestedAction?: string; kind?: "decision" | "error" | "wait" | "blocked" | "standby"; options?: string[]; recommended?: number; resumeAt?: string };
+      const p = params as { reason: string; suggestedAction?: string; kind?: "decision" | "error" | "wait" | "blocked" | "standby"; options?: string[]; recommended?: number; resumeAt?: string; redirect?: string };
       // v0.35.15: a model that passes options but forgets kind="decision"
       // still gets the decision card — a non-empty options array IS the
       // decision intent; silently dropping it left the user with no picker.
@@ -2540,13 +2541,31 @@ function registerAgentTools(pi: any): void {
       // picker can own the screen. The impossible-drop advance is the one
       // exception: the queue already moved to the next item and its
       // continuation owns this turn — aborting would kill the hand-off.
-      if (!droppedImpossible) {
+      // v0.38.97 (field 2026-09-23, dracon-platform): a user redirect is
+      // park-and-CONTINUE, not park-and-stop. When redirect carries the
+      // interrupting request, skip the abort so the turn survives and the
+      // redirect runs NOW — aborting strands it until the user nudges.
+      // Ledgered distinctly so redirect parks don't pollute abort
+      // forensics. An impossible-drop still wins the result copy below.
+      const redirect = (p.redirect ?? "").trim();
+      if (!droppedImpossible && !redirect) {
         try {
           ctx.abort();
           appendLedger(ctx.cwd, "pause_goal_aborted_turn", { goalId: state.goal?.id, kind: p.kind ?? "blocked" });
         } catch (abortError) {
           appendLedger(ctx.cwd, "pause_goal_abort_failed", { goalId: state.goal?.id, error: abortError instanceof Error ? abortError.message : String(abortError) });
         }
+      } else if (redirect && !droppedImpossible) {
+        appendLedger(ctx.cwd, "pause_goal_redirect", { goalId: state.goal?.id, kind: p.kind ?? "blocked" });
+      }
+      if (redirect && !droppedImpossible) {
+        return {
+          content: [{
+            type: "text",
+            text: `Goal parked for a user redirect — do NOT work the goal. Work this NOW in the same turn, without ending the turn: ${redirect}. When it is done, ${activeGoalSurfaceCommand("resume")} the goal (or resume_goal) and continue.${waitClampNotice}`,
+          }],
+          details: {},
+        };
       }
       return {
         content: [{

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "pi-goal-list-loop-audit",
-	"version": "0.38.95",
+	"version": "0.38.97",
 	"description": "Mission control for long running pi work: interview drafted goals, an audited task queue, and metric or audit loops that run for hours. Every completion is rechecked by a detached auditor with raw evidence, while Confirm drafts, decision pauses, and consent gates keep you in charge.",
 	"license": "AGPL-3.0-only",
 	"author": "dracon",