feat: /goal por milestone + disciplina de tokens do orquestrador

DOCS.md

@@ -2517,7 +2517,7 @@ update_roster.
 | `/prd` | `[focus?]` | Quick reviewer opinion on the PRD — never edits it. |
 | `/map` | `[notes?]` | Runs a conditional architecture checkpoint before planning; consequential decisions land in optional `architecture.md`, while simple plans skip it. Then PRD → `map.yaml` + screens-routes + issues/task-master + specs + registry seed + `/ui-components` + milestones; ends by opening the Plan page. |
 | `/task` | `[number\|description?]` | ONE task: the task-sequencer writes the brief (enforcing the theme and env gates); exact `Mode: prototype` → `fda_prototype`, otherwise `fda_plan_build_test` (bigger/riskier normal work → `fda_sdlc`). On first failure: one automatic recovery (re-run / repair once); if that also fails: `npm run fda:phases -- <id>`, resume with `--fda-id <id> --resume`. |
-| `/goal` | `[limit?] [--light]` | All unblocked tasks to done, one FDA per task (never batched), gates inside the loop, human-only steps handled MID-goal; `Mode: prototype` selects `fda_prototype` per brief, otherwise `--light` selects `fda_plan_build_test` and the default is `fda_sdlc`; on failure it recovers automatically while each failure names a NEW gap (the per-run recovery budget is capped in code by `verdict.mjs`), stopping only on a repeated violation, a terminal outcome or a spent budget — always with its recommended fix, which a plain "continue" from the engineer authorizes; every completed milestone automatically runs blocking `fda_qa` before the next milestone; ends with the app RUNNING + "How to test", then `/launch`. |
+| `/goal` | `[limit?] [--light]` | All unblocked tasks to done, one FDA per task (never batched), gates inside the loop, human-only steps handled MID-goal; `Mode: prototype` selects `fda_prototype` per brief, otherwise `--light` selects `fda_plan_build_test` and the default is `fda_sdlc`; on failure it recovers automatically while each failure names a NEW gap (the per-run recovery budget is capped in code by `verdict.mjs`), stopping only on a repeated violation, a terminal outcome or a spent budget — always with its recommended fix, which a plain "continue" from the engineer authorizes; every completed milestone automatically runs blocking `fda_qa`, drains docs with one `fda_document` and — when other milestones remain — ends the loop at the boundary with a 5-line handoff (one milestone per session: state is durable in `ai-docs/`, and a fresh session drops the orchestrator's accumulated context); ends with the app RUNNING + "How to test", then `/launch`. |
 | `/feature` | `"request"` | Delta on an existing mapped system: size triage (module-sized routes UP to `/idea`), delta mini-grill, delta spec, DELTA tasks, approval before executing. Requires `map.yaml` (`/absorb` first otherwise). |
 | `/bug` | `"symptom"` | Classifies `direct` vs `rca`; ambiguous/risky defects get a versioned investigation and critical/sensitive/low-confidence RCAs require approval before claim. Then `fda_bug` enforces an assertion-failing reproduction before any fix. |
 | `/quick` | `"small change"` | Triage; SIMPLE runs `node imp/fda_quick.mjs` + the `Q-NNN` quick-log entry; COMPLEX routes to `/feature`/`/bug` naming the failed criterion. |

pi-templates/.pi/prompts/goal.md

@@ -11,13 +11,21 @@ as /stack) — implementing with an undecided stack is guaranteed rework.
 
 Limit/instructions from the engineer: $@
 
+**Token discipline — your own context is a cost.** This session pays for every
+line it carries forward (a real project's goal session burned 240M tokens
+mostly re-reading its own history). Never paste briefs, reports or FDA output
+into the conversation — reference paths; the viewer (`npm run fda:viewer`) is
+the log. Report each task in ONE line. Never re-read `task-master.md` in full
+— the sequencer owns it. For routine milestones prefer `--light`
+(`fda_plan_build_test`); the full `fda_sdlc` is for bigger/riskier tasks.
+
 **FDA selection (evaluate after each brief is written):** an exact
 `Mode: prototype` line selects `fda_prototype.mjs` for that brief. Otherwise,
 if the engineer's instructions contain `--light`, use
 `fda_plan_build_test.mjs`; the default is `fda_sdlc.mjs`. Prototype takes
 precedence over `--light` because it is the brief's explicit per-task opt-in.
 
-Loop, until no unblocked task remains:
+Loop, until no unblocked task remains OR a milestone boundary closes (step 3):
 
 1. `task-sequencer` → next unblocked issue → brief in `ai-docs/actual-todo/`
    (sequencer stopped on the **theme gate** — right after the greenfield
@@ -57,7 +65,14 @@ Loop, until no unblocked task remains:
    node imp/fda_document.mjs "Document milestone <milestone-id>: what shipped across its tasks — read ai-docs/milestones.md and the completed briefs in ai-docs/todos/, write/update the docs, and commit them"
    ```
 
-   — and continue. QA exit != 0
+   — then, when other milestones remain, **END THIS LOOP at the milestone
+   boundary**: print a 5-line handoff (milestone done, QA report path, next
+   milestone id, "state is durable in ai-docs/ — run `/goal` again in a NEW
+   session to continue"). Every loop artifact lives on disk, so the fresh
+   session loses nothing and starts without this conversation's accumulated
+   weight — one milestone per session is the cheap shape. Only when NO
+   unblocked task remains anywhere do you continue to the final delivery
+   below. QA exit != 0
    → **STOP the goal**; show the phase, rule id/evidence, and artifact path.
    Never silently defer QA, continue into the next milestone, or mark a failed
    milestone complete. This automatic boundary supersedes the cookbook's

pi-templates/.pi/skills/fia/cookbooks/harness_bridge.md

@@ -232,7 +232,14 @@ Rules for the loop:
   `node imp/fda_qa.mjs "<milestone-id>"` before selecting work from a later
   milestone. UI scope requires the validated contract plus Playwright/design
   evidence; API-only writes a reasoned skipped report. Any non-zero QA result
-  STOPS the loop. Never silently defer this boundary.
+  STOPS the loop. Never silently defer this boundary. QA green: drain the
+  milestone's documentation with ONE `fda_document` run (per-task runs skip
+  their `document` phase by default — `sdlc.document: per_milestone`), then
+  END the goal loop at this boundary when other milestones remain — hand off
+  in 5 lines and have the engineer run `/goal` again in a NEW session. All
+  state is durable in `ai-docs/`; a fresh session per milestone avoids the
+  accumulated orchestrator context that is the biggest hidden token cost of
+  a long goal.
 
 ## Step 4 — Deliver it RUNNING (definition of done)
 

test/fia-sdlc-repair.test.js

@@ -142,3 +142,14 @@ test('the shipped config template documents the sdlc block and /goal drains mile
   assert.match(goal, /node imp\/fda_document\.mjs "Document milestone/);
   assert.match(goal, /sdlc\.document: per_milestone/);
 });
+
+test('the goal loop is milestone-scoped and token-disciplined', () => {
+  const goal = readFileSync(new URL('../pi-templates/.pi/prompts/goal.md', import.meta.url), 'utf8');
+  assert.match(goal, /Token discipline/);
+  assert.match(goal, /Never paste briefs, reports or FDA output/);
+  assert.match(goal, /END THIS LOOP at the milestone\s+boundary/);
+  assert.match(goal, /run `\/goal` again in a NEW\s+session/);
+  const bridge = readFileSync(new URL('../pi-templates/.pi/skills/fia/cookbooks/harness_bridge.md', import.meta.url), 'utf8');
+  assert.match(bridge, /END the goal loop at this boundary/);
+  assert.match(bridge, /fresh session per milestone/);
+});