pi-crew 0.9.68 → 0.10.2

package/src/runtime/plan-approval.ts

@@ -0,0 +1,125 @@
+/**
+ * Plan-approval gate helpers.
+ *
+ * Extracted from team-runner.ts (2026-08, Phase 2.6 maintainability split —
+ * plan-approval family). Pure code motion: requiresPlanApproval /
+ * isPlanApprovalPending / isMutatingTask / ensurePlanApprovalRequested moved
+ * verbatim from team-runner.ts. cancelPlanTasks stays in team-runner.ts
+ * (RT-14 structural source-pin test requires it defined there).
+ */
+
+import * as fs from "node:fs";
+import type { CrewRuntimeConfig } from "../config/config.ts";
+import { parsePlannerPlanOutput } from "../extension/plan-orchestrate.ts";
+import { appendEvent } from "../state/event-log/event-log.ts";
+import { appendPlanRevision, getCurrentPlanRecord, setPlanApproval } from "../state/stores/plan-store.ts";
+import { saveRunManifestAsync } from "../state/stores/state-store.ts";
+import type { PlanRecord, TeamRunManifest, TeamTaskState } from "../state/types.ts";
+import type { WorkflowConfig } from "../workflows/workflow-config.ts";
+import { permissionForRole } from "./role-permission.ts";
+
+export function requiresPlanApproval(_workflow: WorkflowConfig, runtimeConfig: CrewRuntimeConfig | undefined): boolean {
+	// ROADMAP T1.2: plan-level HITL applies to ANY workflow when
+	// config.runtime.requirePlanApproval === true (not just 'implementation').
+	// The gate fires at the read-only → mutating (plan → execute) boundary.
+	return runtimeConfig?.requirePlanApproval === true;
+}
+
+/** State-level predicate shared by every render surface (widget badge,
+ *  progress banner, powerbar segment) so gating is byte-identical to the
+ *  action side: `required === true && status === "pending"`. A malformed
+ *  manifest (`pending` without `required`) must NOT light up surfaces while
+ *  keys/backends refuse — single source of truth (WP-3 review F2). */
+export function isPlanApprovalStatePending(approval: TeamRunManifest["planApproval"]): boolean {
+	return approval?.required === true && approval.status === "pending";
+}
+
+export function isPlanApprovalPending(manifest: TeamRunManifest): boolean {
+	return isPlanApprovalStatePending(manifest.planApproval);
+}
+
+/**
+ * T2/R4 (ADR-4 §2, reader migration): plan-record-first approval predicate
+ * with manifest fallback. The current revision's approval state, when present,
+ * is authoritative; otherwise the legacy manifest gate decides. Pre-v2 runs
+ * (no plans.json) take exactly the old path — pinned by the migration
+ * negative AC in plan-store.test.ts.
+ */
+export function isPlanApprovalPendingEffective(manifest: TeamRunManifest): boolean {
+	const current = getCurrentPlanRecord(manifest);
+	if (current?.approval) return current.approval.status === "pending";
+	return isPlanApprovalPending(manifest);
+}
+
+/**
+ * T2/R4 (ADR-4 §8 vocabulary mapping): a deny is `cancelled` on the manifest
+ * side and `rejected` on the record side — either means "decided negative"
+ * to the scheduler cancel paths (team-runner.ts readers).
+ */
+export function isPlanApprovalDenied(manifest: TeamRunManifest): boolean {
+	if (manifest.planApproval?.status === "cancelled") return true;
+	return getCurrentPlanRecord(manifest)?.approval?.status === "rejected";
+}
+
+export function isMutatingTask(task: TeamTaskState): boolean {
+	return permissionForRole(task.role) !== "read_only";
+}
+
+export async function ensurePlanApprovalRequested(manifest: TeamRunManifest, tasks: TeamTaskState[]): Promise<TeamRunManifest> {
+	if (manifest.planApproval) return manifest;
+	const assessTask = tasks.find((task) => task.stepId === "assess" && task.status === "completed");
+	// ROADMAP T1.2: for non-adaptive workflows, fall back to the most recent
+	// completed read-only (planning) task as the plan reference.
+	const planTask = assessTask ?? [...tasks].reverse().find((t) => t.status === "completed" && !isMutatingTask(t));
+	const now = new Date().toISOString();
+
+	// T2/R4 (ADR-4 §6 producer 3 + §8 dual-write): make sure a PlanRecord
+	// exists before the gate lights up, so approval names plan id+version.
+	// - Record already present (adaptive producer ran, or a re-request after
+	//   crash between the record append and the manifest save) → reuse it.
+	// - No record → try the planner-tagged `<plan>` contract on the plan
+	//   artifact; if that fails → manifest-only gate (pre-v2 behavior, the
+	//   dual-read fallback in plan-store keeps readers correct).
+	let record = getCurrentPlanRecord(manifest);
+	if (!record && planTask?.resultArtifact?.path) {
+		try {
+			const text = fs.readFileSync(planTask.resultArtifact.path, "utf-8");
+			const parsed: PlanRecord | undefined = parsePlannerPlanOutput(text, manifest.runId, planTask.id);
+			if (parsed) record = appendPlanRevision(manifest, parsed);
+		} catch {
+			// Unreadable/unparsable artifact → manifest-only gate (below); the
+			// gate must still light up — never a throw here.
+		}
+	}
+	if (record) {
+		setPlanApproval(manifest, { status: "pending", planVersion: record.version });
+	}
+
+	const updated: TeamRunManifest = {
+		...manifest,
+		updatedAt: now,
+		planApproval: {
+			required: true,
+			status: "pending",
+			requestedAt: now,
+			updatedAt: now,
+			planTaskId: planTask?.id,
+			planArtifactPath: planTask?.resultArtifact?.path,
+		},
+		plan: record ? { id: record.id, version: record.version } : manifest.plan,
+	};
+	await saveRunManifestAsync(updated);
+	appendEvent(updated.eventsPath, {
+		type: "plan.approval_required",
+		runId: updated.runId,
+		taskId: planTask?.id,
+		message: "Plan requires explicit approval before mutating tasks run. Use: team api op=approve-plan runId=...",
+		data: { planArtifactPath: planTask?.resultArtifact?.path, planId: record?.id, planVersion: record?.version },
+	});
+	return updated;
+}
+
+/** @internal 1.9(b) test export — exercise requiresPlanApproval directly. */
+export const __test__requiresPlanApproval = requiresPlanApproval;
+/** @internal 1.9(b) test export — exercise ensurePlanApprovalRequested directly. */
+export const __test__ensurePlanApprovalRequested = ensurePlanApprovalRequested;

package/src/runtime/plan-replan.ts

@@ -0,0 +1,151 @@
+/**
+ * T2/R4 (ADR-4 §4) — re-plan sweep: dropped-item soft-cancel.
+ *
+ * Every scheduler tick (selectDispatchBatch, after the ask-deadline sweep)
+ * checks the CURRENT plan revision for `dropped` items and reconciles their
+ * tasks:
+ *  - QUEUED tasks are cancelled outright (never dispatched — the re-plan
+ *    removed their reason to exist).
+ *  - RUNNING / WAITING / NEEDS_ATTENTION tasks get a SOFT cancel: a wrap-up
+ *    advisory appended to the worker's steering file (the same JSONL contract
+ *    as `team steer` and the ChildPiSteeringController soft limit — advisory
+ *    first, the existing maxTurns+grace machinery stays the hard enforcement).
+ *    `task.replanDroppedAt` stamps the advisory as issued (exactly-once across
+ *    ticks) and doubles as the terminal marker "cancelled-by-replan".
+ *  - A `plan.item.dropped` event is appended per affected task.
+ *
+ * Reload+persist discipline mirrors sweepExpiredWaitingTasks: best-effort
+ * reload, all mutations under withRunLockSync with a fresh in-lock reload,
+ * save only when something changed. Never throws into the scheduler tick —
+ * failures are logged and the sweep returns undefined (next tick retries).
+ */
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { withRunLockSync } from "../state/coordination/locks.ts";
+import { appendEvent } from "../state/event-log/event-log.ts";
+import { getCurrentPlanRecord } from "../state/stores/plan-store.ts";
+import { loadRunManifestById, saveRunManifest, saveRunTasks } from "../state/stores/state-store.ts";
+import type { TeamRunManifest, TeamTaskState } from "../state/types.ts";
+import { logInternalError } from "../utils/internal-error.ts";
+import { resolveRealContainedPath } from "../utils/safe-paths.ts";
+
+export interface DroppedPlanSweepResult {
+	manifest: TeamRunManifest;
+	tasks: TeamTaskState[];
+	cancelledTaskIds: string[];
+	advisedTaskIds: string[];
+}
+
+const WRAP_UP_ADVISORY =
+	"Plan item dropped by a newer plan revision (re-plan). Wrap up immediately — provide your best final answer now; this task will not be continued.";
+
+function appendSteeringAdvisory(manifest: TeamRunManifest, taskId: string): boolean {
+	try {
+		const steeringDir = path.join(manifest.artifactsRoot, "steering");
+		fs.mkdirSync(steeringDir, { recursive: true });
+		const safePath = resolveRealContainedPath(steeringDir, `${taskId}.jsonl`);
+		// Same 256KB growth cap as the steer tool (subagent-tools.ts) — refuse
+		// loudly rather than poisoning the next incarnation's first poll.
+		try {
+			if (fs.statSync(safePath).size > 256 * 1024) {
+				logInternalError("plan-replan.steer-refused-too-large", new Error("steering file over cap"), `taskId=${taskId}`);
+				return false;
+			}
+		} catch {
+			/* no file yet — fine */
+		}
+		fs.appendFileSync(
+			safePath,
+			`${JSON.stringify({ type: "steer", message: WRAP_UP_ADVISORY, ts: new Date().toISOString() })}\n`,
+			"utf-8",
+		);
+		return true;
+	} catch (error) {
+		logInternalError("plan-replan.steer-write-failed", error instanceof Error ? error : new Error(String(error)), `taskId=${taskId}`);
+		return false;
+	}
+}
+
+/**
+ * Takes the scheduler's IN-MEMORY manifest+tasks (selectDispatchBatch already
+ * holds both) — NO disk load on the no-op path. The per-tick cost for runs
+ * without plan-linked tasks is one array scan; plans.json is only read when a
+ * task carries planItem, and the reload+persist below only runs when an
+ * affected task actually exists.
+ */
+export function sweepDroppedPlanItems(initialManifest: TeamRunManifest, initialTasks: TeamTaskState[]): DroppedPlanSweepResult | undefined {
+	// Cheap exits FIRST (no I/O): no plan-linked tasks at all.
+	if (!initialTasks.some((t) => t.planItem)) return undefined;
+	const record = getCurrentPlanRecord(initialManifest);
+	if (!record) return undefined;
+	const dropped = new Set(record.items.filter((i) => i.status === "dropped").map((i) => i.id));
+	if (dropped.size === 0) return undefined;
+	if (!initialTasks.some((t) => t.planItem && dropped.has(t.planItem))) return undefined;
+
+	const cwd = initialManifest.cwd;
+	const runId = initialManifest.runId;
+	const cancelledTaskIds: string[] = [];
+	const advisedTaskIds: string[] = [];
+	try {
+		const outcome = withRunLockSync(initialManifest, () => {
+			const fresh = loadRunManifestById(cwd, runId); // in-lock consistent read
+			if (!fresh) return null;
+			const freshRecord = getCurrentPlanRecord(fresh.manifest);
+			if (!freshRecord) return null;
+			const freshDropped = new Set(freshRecord.items.filter((i) => i.status === "dropped").map((i) => i.id));
+			if (freshDropped.size === 0) return null;
+			let tasks = fresh.tasks;
+			let changed = false;
+			for (const task of fresh.tasks) {
+				if (!task.planItem || !freshDropped.has(task.planItem)) continue;
+				if (task.status === "queued") {
+					// Never dispatched — cancel outright.
+					tasks = tasks.map((t) =>
+						t.id === task.id
+							? {
+									...t,
+									status: "cancelled" as const,
+									finishedAt: new Date().toISOString(),
+									error: "Plan item dropped by re-plan.",
+								}
+							: t,
+					);
+					cancelledTaskIds.push(task.id);
+					appendEvent(fresh.manifest.eventsPath, {
+						type: "plan.item.dropped",
+						runId,
+						taskId: task.id,
+						message: `Task ${task.id} cancelled: plan item '${task.planItem}' dropped by re-plan v${freshRecord.version}.`,
+						data: { itemId: task.planItem, planId: freshRecord.id, planVersion: freshRecord.version },
+					});
+					changed = true;
+				} else if (
+					(task.status === "running" || task.status === "waiting" || task.status === "needs_attention") &&
+					!task.replanDroppedAt
+				) {
+					// In flight — advisory once; maxTurns+grace stays the hard stop.
+					if (!appendSteeringAdvisory(fresh.manifest, task.id)) continue;
+					tasks = tasks.map((t) => (t.id === task.id ? { ...t, replanDroppedAt: new Date().toISOString() } : t));
+					advisedTaskIds.push(task.id);
+					appendEvent(fresh.manifest.eventsPath, {
+						type: "plan.item.dropped",
+						runId,
+						taskId: task.id,
+						message: `Wrap-up advisory delivered to ${task.id}: plan item '${task.planItem}' dropped by re-plan v${freshRecord.version}.`,
+						data: { itemId: task.planItem, planId: freshRecord.id, planVersion: freshRecord.version, softCancel: true },
+					});
+					changed = true;
+				}
+			}
+			if (!changed) return { manifest: fresh.manifest, tasks: fresh.tasks, cancelledTaskIds, advisedTaskIds };
+			saveRunTasks(fresh.manifest, tasks);
+			const manifest = { ...fresh.manifest, updatedAt: new Date().toISOString() };
+			saveRunManifest(manifest);
+			return { manifest, tasks, cancelledTaskIds, advisedTaskIds };
+		});
+		return outcome ?? undefined;
+	} catch (error) {
+		logInternalError("plan-replan.sweep-failed", error instanceof Error ? error : new Error(String(error)), `runId=${runId}`);
+		return undefined;
+	}
+}

package/src/runtime/process-status.ts

@@ -25,6 +25,12 @@ const ERROR_VISIBILITY_GRACE_MS = 10 * 60 * 1000;
 /** Maximum age (ms) for an active run before it's considered stale.
  * After this time, PID-only liveness is unreliable due to PID recycling. */
 const STALE_ACTIVE_RUN_MS = 30 * 60 * 1000;
+/** Window (ms) during which an active run whose agents are all
+ * completed/queued-without-evidence still counts as display-active: the
+ * runner just wrote the manifest (task transition) and the next worker has
+ * not recorded progress yet. Without this the dock flickers off between
+ * phases of a healthy run. */
+const SPAWN_GAP_VISIBILITY_MS = 60 * 1000;
 
 export function checkProcessLiveness(pid: number | undefined): ProcessLiveness {
 	if (pid === undefined || !Number.isInteger(pid) || pid <= 0) {
@@ -150,5 +156,14 @@ export function isDisplayActiveRun(run: TeamRunManifest, agents: CrewAgentRecord
 	// runs, or from cross-cwd registry history; showing them causes noisy 0/0 rows and
 	// needless spinner redraws. The full dashboard can still list historical runs.
 	if (agents.length === 0) return false;
-	return agents.some(hasDurableActiveAgentEvidence);
+	if (agents.some(hasDurableActiveAgentEvidence)) return true;
+	// Spawn gap between phases: an active run whose manifest was JUST written
+	// and whose next agents are queued/waiting without evidence yet stays
+	// visible — the runner is alive and about to spawn them. Stale manifests
+	// (zombies) fall through and stay hidden.
+	if (agents.some((agent) => agent.status === "queued" || agent.status === "waiting")) {
+		const updatedAt = new Date(run.updatedAt).getTime();
+		if (Number.isFinite(updatedAt) && now - updatedAt < SPAWN_GAP_VISIBILITY_MS) return true;
+	}
+	return false;
 }

package/src/runtime/recovery/checkpoint.ts

@@ -166,13 +166,6 @@ export function getCheckpointStore(stateRoot: string): CheckpointStore {
 	return _stores.get(stateRoot)!;
 }
 
-/**
- * Clear all checkpoint stores (for testing).
- */
-export function clearCheckpointStores(): void {
-	_stores.clear();
-}
-
 /**
  * Save a checkpoint during agent execution.
  */
@@ -219,17 +212,6 @@ export function loadCheckpoint(runId: string, taskId: string, cwd?: string): Che
 	return store.load(runId, taskId);
 }
 
-/**
- * Delete a checkpoint after successful completion.
- */
-export function clearCheckpoint(runId: string, taskId: string, cwd?: string): void {
-	assertSafePathId("runId", runId);
-	assertSafePathId("taskId", taskId);
-	const stateRoot = path.join(projectCrewRoot(cwd ?? process.cwd()), "state", "runs", runId);
-	const store = getCheckpointStore(stateRoot);
-	store.delete(runId, taskId);
-}
-
 /**
  * Check if a checkpoint exists for a task.
  */

package/src/runtime/recovery/crash-recovery.ts

@@ -6,7 +6,7 @@ import type { MetricRegistry } from "../../observability/metric-registry.ts";
 import { withRunLockSync } from "../../state/coordination/locks.ts";
 import { appendEvent, scanSequence } from "../../state/event-log/event-log.ts";
 import { readActiveRunRegistry, unregisterActiveRun } from "../../state/stores/active-run-registry.ts";
-import { loadRunManifestById, saveRunTasks, updateRunStatus } from "../../state/stores/state-store.ts";
+import { loadRunManifestById, saveRunManifest, saveRunTasks, updateRunStatus } from "../../state/stores/state-store.ts";
 import type { TeamTaskState } from "../../state/types.ts";
 import { logInternalError } from "../../utils/internal-error.ts";
 import { projectCrewRoot, userCrewRoot } from "../../utils/paths.ts";
@@ -17,7 +17,7 @@ import { isWorkerHeartbeatStale } from "../heartbeat/worker-heartbeat.ts";
 import { terminateLiveAgentsForRun } from "../live-session/live-agent-manager.ts";
 import type { ManifestCache } from "../manifest-cache.ts";
 import { checkProcessLiveness } from "../process-status.ts";
-import { isPlanApprovalPending, type ReconcileResult, reconcileStaleRun } from "../stale-reconciler.ts";
+import { isIntentionalWait, isPlanApprovalPendingEffective, type ReconcileResult, reconcileStaleRun } from "../stale-reconciler.ts";
 
 export interface RecoveryPlan {
 	runId: string;
@@ -114,7 +114,10 @@ export function detectInterruptedRuns(
 	for (const manifest of manifestCache.list(50)) {
 		if (manifest.status !== "running" && manifest.status !== "blocked") continue;
 		// Preserve runs intentionally blocked on plan approval — not crashes.
-		if (isPlanApprovalPending(manifest)) continue;
+		// B1 battery 2026-08-18 (case b): generalized to isIntentionalWait — a run
+		// parked on an ask answer is equally intentional and must not be auto-resumed
+		// out from under its parked worker.
+		if (isIntentionalWait(manifest)) continue;
 		if (manifest.async?.pid !== undefined && checkProcessLiveness(manifest.async.pid).alive) continue;
 		// Skip runs owned by the current live session — a live session B must NOT
 		// detect session A's still-running run as interrupted.
@@ -142,54 +145,87 @@ export async function applyRecoveryPlan(plan: RecoveryPlan, ctx: Pick<ExtensionC
 		runId: plan.runId,
 		cwd: ctx.cwd,
 	});
-	appendHookEvent(loaded.manifest, hookReport);
-	if (hookReport.outcome === "block") {
-		appendEvent(loaded.manifest.eventsPath, {
-			type: "crew.run.recovery_blocked",
+
+	// R14-4: the hook await above is an arbitrary async gap — a concurrent writer
+	// may have completed/cancelled the run in the meantime. Re-read inside the
+	// lock and derive every write from the FRESH snapshot; never reset a run that
+	// reached a terminal status.
+	withRunLockSync(loaded.manifest, () => {
+		const fresh = loadRunManifestById(ctx.cwd, plan.runId); // NOTE: inside withRunLockSync - consistent read
+		if (!fresh) throw new Error(`Run '${plan.runId}' not found.`);
+		if (fresh.manifest.status === "completed" || fresh.manifest.status === "failed" || fresh.manifest.status === "cancelled") {
+			// Run reached a terminal status while the recovery hook was running —
+			// do NOT reset it (no task reset, no status change).
+			appendEvent(fresh.manifest.eventsPath, {
+				type: "crew.run.recovery_skipped",
+				runId: plan.runId,
+				message: `Recovery skipped: run is already '${fresh.manifest.status}'`,
+				data: { status: fresh.manifest.status },
+			});
+			return;
+		}
+		appendHookEvent(fresh.manifest, hookReport);
+		if (hookReport.outcome === "block") {
+			appendEvent(fresh.manifest.eventsPath, {
+				type: "crew.run.recovery_blocked",
+				runId: plan.runId,
+				message: `Recovery blocked by hook: ${hookReport.reason ?? "run_recovery hook blocked the operation."}`,
+				data: { hookOutcome: "block", reason: hookReport.reason },
+			});
+			return;
+		}
+
+		const reset = new Set(plan.resumableTasks);
+		const tasks = fresh.tasks.map((task) =>
+			reset.has(task.id)
+				? {
+						...task,
+						status: "queued" as const,
+						startedAt: undefined,
+						finishedAt: undefined,
+						error: undefined,
+						heartbeat: undefined,
+						// WP-2/R2 (ADR-0 item 9): a requeued task must not resume parked
+						// state — drop any stale ask-park marker along with the other
+						// per-attempt transient fields. Tasks NOT reset (e.g. a task parked
+						// in `waiting`) pass through untouched, marker intact; the marker's
+						// deadline is then owned by the scheduler tick (dispatch-batch).
+						waiting: undefined,
+					}
+				: task,
+		);
+		saveRunTasks(fresh.manifest, tasks);
+		appendEvent(fresh.manifest.eventsPath, {
+			type: "crew.run.resumed",
 			runId: plan.runId,
-			message: `Recovery blocked by hook: ${hookReport.reason ?? "run_recovery hook blocked the operation."}`,
-			data: { hookOutcome: "block", reason: hookReport.reason },
+			message: `Recovered ${plan.resumableTasks.length} interrupted task(s).`,
+			data: {
+				recoveredFromSeq: plan.lastEventSeq,
+				resumableTasks: plan.resumableTasks,
+			},
 		});
-		return;
-	}
-
-	const reset = new Set(plan.resumableTasks);
-	const tasks = loaded.tasks.map((task) =>
-		reset.has(task.id)
-			? {
-					...task,
-					status: "queued" as const,
-					startedAt: undefined,
-					finishedAt: undefined,
-					error: undefined,
-					heartbeat: undefined,
-				}
-			: task,
-	);
-	saveRunTasks(loaded.manifest, tasks);
-	appendEvent(loaded.manifest.eventsPath, {
-		type: "crew.run.resumed",
-		runId: plan.runId,
-		message: `Recovered ${plan.resumableTasks.length} interrupted task(s).`,
-		data: {
-			recoveredFromSeq: plan.lastEventSeq,
-			resumableTasks: plan.resumableTasks,
-		},
+		registry?.counter("crew.run.count", "Total runs by status").inc({ status: "resumed" });
 	});
-	registry?.counter("crew.run.count", "Total runs by status").inc({ status: "resumed" });
 }
 
 export function declineRecoveryPlan(plan: RecoveryPlan, ctx: Pick<ExtensionContext, "cwd">): void {
 	const loaded = loadRunManifestById(ctx.cwd, plan.runId); // NOTE: no withRunLock - best-effort only; concurrent writes may cause inconsistency
 	if (!loaded) throw new Error(`Run '${plan.runId}' not found.`);
-	// Log the event first — if appendEvent fails, state remains consistent.
-	appendEvent(loaded.manifest.eventsPath, {
-		type: "crew.run.recovery_declined",
-		runId: plan.runId,
-		message: "Interrupted run was not resumed.",
-		data: { recoveredFromSeq: plan.lastEventSeq },
+	// R14-4: re-read inside the lock so the decline decision applies to the
+	// on-disk state, not the best-effort snapshot read above. Kept SYNC —
+	// withRunLockSync is the sync lock variant.
+	withRunLockSync(loaded.manifest, () => {
+		const fresh = loadRunManifestById(ctx.cwd, plan.runId); // NOTE: inside withRunLockSync - consistent read
+		if (!fresh) return;
+		// Log the event first — if appendEvent fails, state remains consistent.
+		appendEvent(fresh.manifest.eventsPath, {
+			type: "crew.run.recovery_declined",
+			runId: plan.runId,
+			message: "Interrupted run was not resumed.",
+			data: { recoveredFromSeq: plan.lastEventSeq },
+		});
+		updateRunStatus(fresh.manifest, "cancelled", "interrupted-not-resumed");
 	});
-	updateRunStatus(loaded.manifest, "cancelled", "interrupted-not-resumed");
 }
 
 /**
@@ -224,9 +260,14 @@ export function cancelOrphanedRuns(
 	// Phase 1: Scan project-level manifests via manifestCache
 	for (const manifest of manifestCache.list(50)) {
 		if (manifest.status !== "running" && manifest.status !== "blocked") continue;
-		// Preserve plan-approval-blocked runs — they belong to their owner and are
-		// waiting on a human decision, not orphaned by a dead owner process.
-		if (isPlanApprovalPending(manifest)) {
+		// B1 battery 2026-08-18 (case b): preserve runs intentionally blocked on a
+		// HUMAN DECISION — plan approval (pre-v2 semantics) OR a pending ask answer
+		// within the waiting TTL (ADR-0 item 9: "not crashes and must not be
+		// stale-repaired or cancelled by reconciliation"). Live proof: a resumed
+		// run parked on ask (worker alive, waitState set, parked workers do NOT
+		// heartbeat) was orphan-cancelled 5m18s into a 10-minute park by a THIRD
+		// session's startup scan because the predicate only knew plan approval.
+		if (isIntentionalWait(manifest)) {
 			skipped.push(manifest.runId);
 			continue;
 		}
@@ -242,6 +283,22 @@ export function cancelOrphanedRuns(
 			continue;
 		}
 
+		// Foreground (in-process) runs have NO async worker PID, so the liveness
+		// check above cannot apply. They execute inside THIS pi process — a
+		// recently-updated manifest conclusively proves the run is alive; only a
+		// run that has gone quiet for the stale threshold can be an orphan (a
+		// crashed process stops updating). Without this, a YOUNG foreground run
+		// (first worker heartbeat not yet written) was orphan-cancelled by the
+		// session that opened its agent view seconds after the run started —
+		// killing the very run the user was looking at.
+		if (!manifest.async) {
+			const updatedMs = manifest.updatedAt ? new Date(manifest.updatedAt).getTime() : Number.NaN;
+			if (Number.isFinite(updatedMs) && now - updatedMs <= staleThresholdMs) {
+				skipped.push(manifest.runId);
+				continue;
+			}
+		}
+
 		// Check for recent heartbeat activity
 		const loaded = loadRunManifestById(cwd, manifest.runId); // NOTE: no withRunLock - best-effort only; concurrent writes may cause inconsistency
 		if (!loaded) continue;
@@ -293,6 +350,14 @@ export function cancelOrphanedRuns(
 			});
 
 			saveRunTasks(fresh.manifest, repairedTasks);
+			// B1 battery 2026-08-18 (case b leak fix): a cancelled run must not keep
+			// its waitState pointer — observed live: orphan-cancel left waitState set,
+			// shielding the dead run from staleness repair for the full 24h TTL.
+			if (fresh.manifest.waitState) {
+				const cleared = { ...fresh.manifest, waitState: undefined, updatedAt: new Date(now).toISOString() };
+				saveRunManifest(cleared);
+				fresh.manifest = cleared;
+			}
 			for (const task of repairedTasks) {
 				try {
 					upsertCrewAgent(fresh.manifest, recordFromTask(fresh.manifest, task, "scaffold"));
@@ -655,7 +720,7 @@ export function reconcileAllStaleRuns(
 			// Belt-and-suspenders: reconcileStaleRun itself guards this, but the run
 			// may have flipped to blocked+plan-approval between cache-list and lock
 			// acquisition — re-check the freshest manifest under the lock.
-			if (isPlanApprovalPending(fresh.manifest)) {
+			if (isPlanApprovalPendingEffective(fresh.manifest)) {
 				results.push({
 					runId,
 					verdict: "blocked_awaiting_approval",