pi-plans 0.6.0 → 0.8.0

package/src/exec.ts

@@ -1,15 +1,24 @@
 /**
- * Plan-execution loop: the tracked execution mode for accepted plans.
+ * Plan-execution loop (v0.6.1): the tracked execution mode for accepted
+ * plans, driven by the plan's task tree.
  *
  * When the user approves the execution handoff, the extension switches into
- * execution mode: every agent turn is injected with the remaining verifier
- * checklist, assistant messages are scanned for [DONE:VC-xxx] markers, and
- * progress is reported through the bottom status bar until every item passes.
+ * execution mode: every agent turn is injected with the current wave and
+ * remaining tasks, task progress flows in exclusively through the
+ * `plans_update_task` tool (status + evidence), the task dashboard shows
+ * live progress (compact aboveEditor widget; Ctrl+Shift+T expands the full
+ * tree), a stall watchdog pauses the run when consecutive rounds produce no
+ * task-state change, and when every task reaches a terminal state an
+ * independent execution reviewer verifies the plan's verification checks in
+ * a detached, overlay-visible loop — failed checks roll their covered tasks
+ * back to pending (audit-flow-only channel), and five committed rounds pause
+ * the run for the user in every mode (fail-closed, never a silent stop).
  */
 
 import * as fs from "node:fs";
 import * as path from "node:path";
-import { randomUUID } from "node:crypto";
+import { createHash, randomUUID } from "node:crypto";
+import { execSync } from "node:child_process";
 import type {
 	CompactionResult,
 	ExtensionAPI,
@@ -36,11 +45,10 @@ import {
 	type VccCompactionBuildResult,
 	type VccCompactionStats,
 } from "./compaction.ts";
-import { TERMINAL_RUN_STATUSES, getRun, latestRun, lintPlanIntoNotices, loadConfig, readActive, resolveStateRootOrNull, setRunStatus, StateError, utcNow } from "./state.ts";
-import { execChrome, resolveUiLanguage, type UiLanguage } from "./ui-language.ts";
+import { TERMINAL_RUN_STATUSES, getRun, latestRun, lintPlanIntoNotices, loadConfig, readActive, resolveStateRootOrNull, runDirPath, setRunStatus, StateError, utcNow } from "./state.ts";
+import { resolveUiLanguage, type UiLanguage } from "./ui-language.ts";
 import { bindRun, resolveActiveRun } from "./run-context.ts";
-import { runPiSubagent, type SubagentProgressEvent } from "./subagent.ts";
-import { RefineOverlayController, refineOverlayContext } from "./refine-ui.ts";
+import type { SubagentProgressEvent } from "./subagent.ts";
 import { OwnershipError } from "./run-ownership.ts";
 import {
 	applyExecutionApproved,
@@ -48,86 +56,104 @@ import {
 	applyExecutionHeadChanged,
 	applyExecutionProgress,
 	applyExecutionStopped,
-	applyQuestionAsked,
-	applyReviewRoundStarted,
 	createCheckpoint,
 	loadCheckpoint,
 	mutateCheckpoint,
-	StaleCheckpointError,
 	planIdentityOf,
 	resolveHeadAt,
 	resolveWorktreeRoot,
 	sha256File,
+	StaleCheckpointError,
 	type ExecutionApproval,
+	type WorkflowCheckpoint,
 } from "./workflow-state.ts";
 import { graphBlockForExecutor } from "./code-graph/prompts.ts";
-import {
-	PANEL_WIDGET_KEY,
-	derivePanelModel,
-	deriveNextAction,
-	deriveImplReviewLoopModel,
-	formatImplReviewLoopSummaryLine,
-	formatPanelSummaryLine,
-	renderImplReviewLoopLines,
-	renderPanelLines,
-	themeImplReviewLoopLines,
-	themePanelLines,
-} from "./panel.ts";
 import { resolveGraphMode } from "./code-graph/mode.ts";
 import {
-	TERMINATION_QUESTION,
-	TERMINATION_OPTIONS,
-	TERMINATION_RECORDING_INSTRUCTIONS,
-	defaultImplReviewers,
-	implReviewerCountPromptLine,
-	renderTerminationOptions,
-} from "./termination-prompt.ts";
-import {
-	extractCoverage,
-	latestPlanVersion,
 	parseChecklist,
-	parseImplItems,
-	resolveImplStatuses,
-	scanDoneMarkers,
-	scanImplMarkers,
-	scanCurrentIMarkers,
-	resolveCurrentI,
-	inferCurrentI,
-	lintImplItems,
+	parsePlanTasks,
+	flattenTasks,
 	type CheckItem,
-	type ImplItem,
-	type ImplMarkerState,
+	type PlanTasks,
 } from "./plan.ts";
+import {
+	allTasksTerminal,
+	auditRollbackSet,
+	auditableChecks,
+	buildTaskView,
+	currentTask,
+	flattenTaskViews,
+	invalidateChecksForRolledBackTasks,
+	taskIsTerminal,
+	taskProgress,
+	taskProgressMap,
+	type TaskProgressMap,
+	type TaskView,
+} from "./tasks.ts";
+import { isAutoApproveEnabled as isAutoApproveEnabledLocal } from "./auto-approve.ts";
+import {
+	DASHBOARD_WIDGET_KEY,
+	deriveDashboardModel,
+	formatDashboardSummaryLine,
+	formatElapsed,
+	renderDashboardLines,
+	renderDashboardTreeLines,
+} from "./dashboard.ts";
+import { REVIEW_MAX_ROUNDS, presolvedCheckIds, runCompletionAudit, writeReviewRoundReport, type AuditRoundResult } from "./auditor.ts";
+import { staleReloadHint as probeStaleReload } from "./staleness.ts";
+import { messaging } from "./messaging.ts";
+import { RefineOverlayController, refineOverlayContext } from "./refine-ui.ts";
+import { applyRefineProgress, applyRefineResult, type RefineLaneState } from "./refine-ui-state.ts";
+import { resolveReviewerSpawn } from "./thinking-levels.ts";
+import { loadGlobalConfig, reviewerReady } from "./global-state.ts";
 
 export interface ExecState {
 	planPath: string;
+	/** Verification checks (VC-###) — the audit's contract. */
 	items: CheckItem[];
+	/** Parsed plan task model (kept for re-deriving the view). */
+	planTasks: PlanTasks;
+	/** Live task tree (the single source of progress). */
+	tasks: TaskView[];
+	/** True when the plan parsed through the legacy I-### fallback. */
+	legacyPlan: boolean;
 	startedAt: string;
 	usage: { inToks: number; outToks: number };
-	implItems?: ImplItem[];
-	implStatus?: Record<string, ImplMarkerState>;
-	/** Plan-lint warning backing the panel's implWarning line. */
-	implWarning?: string | null;
-	/** Chrome language for panel/status strings (issue #3); undefined → "en". */
+	/** Chrome language for panel/status strings; undefined → "en". */
 	uiLanguage?: UiLanguage;
-	currentI?: string;
-	goalWait?: GoalWaitState;
-	/** v0.6.0: set while a delegated executor child owns the implementation.
-	 * Persisted subset only (modelSelector + startedAt); the AbortController is
-	 * runtime state kept in delegatedRuntime, never persisted. */
-	delegate?: { modelSelector: string; startedAt: string };
+	/** Stall watchdog (v0.6.1): consecutive settled rounds without a task
+	 * status change; auto-pause at the cap. */
+	stall: { rounds: number; lastSnapshot: string | null; paused: boolean; pausedReason?: string };
+	/** Completion-audit bookkeeping. `rounds` is the BUDGET counter — charged
+	 * only when a round outcome commits (never on discard/cancel) — and is the
+	 * only piece persisted. */
+	audit: { rounds: number; failed: string[]; undeterminable: string[]; running: boolean };
+	/** Execution-review loop (v0.8), memory-only: the attempt index names the
+	 * per-round report files; consecutiveDiscards bounds the fingerprint
+	 * re-run loop; inFlight owns the round's abort lifecycle. */
+	review: { attempts: number; consecutiveDiscards: number; inFlight: InFlightReview | null };
+	/** Per-settle audit latch (v0.7.1): a settled round fires the completion
+	 * audit at most once, so the turn_end / agent_before_settle / resume entry
+	 * points cannot double-consume a round when several land in one settle.
+	 * Created on demand by auditLatchOf(); every construction path may omit it. */
+	auditLatch?: { auditedThisSettle: boolean; activity: number };
+}
+
+/** One in-flight review round: owns its abort lifecycle, its fingerprint of
+ * the audited subject, and the per-round one-shot wake token (v0.8). */
+interface InFlightReview {
+	controller: AbortController;
+	/** Budget round this attempt belongs to (audit.rounds + 1 at spawn). */
+	budgetRound: number;
+	/** Monotonic attempt ordinal; names the round report file. */
+	attempt: number;
+	fingerprint: string;
+	wakeSent: boolean;
 }
 
 /**
- * D-008 (issue #3): re-resolve the chrome language and repaint the panel and
- * status bar. Called by the plans tool right after a successful
- * `set-language` so an executing run switches language without a restart
- * (and without reading config on every render tick).
- *
- * Capability guard (implementation review F-001): partial contexts (some
- * command/test harnesses expose only notify/select/input) may lack
- * setStatus/theme — the refresh must stay a no-op there instead of throwing
- * into the caller's error path (updateStatusWidget assumes a full ui).
+ * D-008 (issue #3): re-resolve the chrome language and repaint the dashboard
+ * and status bar right after a `set-language` change.
  */
 export function refreshUiLanguage(ctx: ExtensionContext): void {
 	if (execution) execution.uiLanguage = resolveUiLanguage(ctx.cwd);
@@ -135,43 +161,35 @@ export function refreshUiLanguage(ctx: ExtensionContext): void {
 	updateStatusWidget(ctx);
 }
 
-export interface GoalWaitState {
-	noProgressRounds: number;
-	waitRounds: number;
-	/** Marker/progress snapshot of the last goal-wait round; null = baseline not set. */
-	lastMarkers: string | null;
-	paused: boolean;
-	pausedReason?: string;
-}
-
-const GOAL_WAIT_MAX_NO_PROGRESS = 3;
-const GOAL_WAIT_MAX_WAITING = 6;
+/** Consecutive no-progress rounds before the watchdog pauses (D-021). */
+const STALL_MAX_ROUNDS = 3;
 
 let execution: ExecState | null = null;
 
-export const GOAL_WAIT_CUSTOM_TYPE = "pi-plans-goal-wait";
+export const EXECUTION_CONTINUE_CUSTOM_TYPE = "pi-plans-exec-continue";
+/** Legacy v0.6.0 continuation message type — filtered on restore. */
+const LEGACY_GOAL_WAIT_CUSTOM_TYPE = "pi-plans-goal-wait";
 
-interface GoalWaitRuntime {
+interface ContinuationRuntime {
 	owner: ExecState;
 	session: ExtensionContext["sessionManager"];
 	handled: boolean;
 	stopReason?: string;
-	text: string;
 	wakeId?: string;
 }
 
-// Dispatch identity belongs to a live session, never to a persisted checklist.
-let goalWaitRuntime: GoalWaitRuntime | null = null;
+// Dispatch identity belongs to a live session, never to a persisted state.
+let continuationRuntime: ContinuationRuntime | null = null;
 
-function resetGoalWaitRuntime(ctx: ExtensionContext): void {
-	goalWaitRuntime = execution
-		? { owner: execution, session: ctx.sessionManager, handled: false, text: "" }
+function resetContinuationRuntime(ctx: ExtensionContext): void {
+	continuationRuntime = execution
+		? { owner: execution, session: ctx.sessionManager, handled: false }
 		: null;
 }
 
-function currentGoalWaitRuntime(ctx: ExtensionContext): GoalWaitRuntime | null {
-	return goalWaitRuntime?.owner === execution && goalWaitRuntime.session === ctx.sessionManager
-		? goalWaitRuntime
+function currentContinuationRuntime(ctx: ExtensionContext): ContinuationRuntime | null {
+	return continuationRuntime?.owner === execution && continuationRuntime.session === ctx.sessionManager
+		? continuationRuntime
 		: null;
 }
 
@@ -185,17 +203,14 @@ export function consumePendingExecutionFlush(): boolean {
 	return pending;
 }
 
-function requestExecutionFlush(_pi: ExtensionAPI, _ctx: ExtensionContext): void {
-	// Unconditional defer. turn_end fires mid-run in a gap between agent
-	// operations where isIdle() reads true; persistence happens only at the
-	// drain points: agent_settled, the next before_agent_start, and stop/complete.
+function requestExecutionFlush(): void {
 	pendingExecutionFlush = true;
 }
 
-export function drainExecutionFlush(pi: ExtensionAPI, ctx: ExtensionContext): void {
+export function drainExecutionFlush(ctx: ExtensionContext): void {
 	if (!execution || !pendingExecutionFlush) return;
 	pendingExecutionFlush = false;
-	persist(pi);
+	persist(ctx);
 	updateStatusWidget(ctx);
 }
 
@@ -209,19 +224,22 @@ export interface CheckpointExecutionLoad {
 	doneVcIds?: string[];
 	reverifyAll?: boolean;
 	pausedReason?: string;
+	/** v0.6.1: true when the checkpoint parsed through the legacy fallback. */
+	legacyPlan?: boolean;
+	/** v0.6.1 (D-020): true when an orphaned v0.6.0 delegated executor was
+	 * detected — resume requires a fresh handoff approval. */
+	legacyDelegate?: boolean;
 	error?: string;
 }
 
 /**
- * Shared restore primitive (I-005/I-006): load the executing state from a run
- * checkpoint into THIS session. Authorization is kept only when the recorded
- * approval matches the current plan digest; a HEAD change keeps the
- * authorization but re-verifies previously verified VCs (D-011/F-001).
- * F-002: the loaded state is persisted to the current session IMMEDIATELY so
- * session_start/session_tree restore paths cannot silently clear it.
+ * Shared restore primitive: load the executing state from a run checkpoint
+ * into THIS session. Authorization is kept only when the recorded approval
+ * matches the current plan digest; a HEAD change keeps the authorization but
+ * re-opens previously closed tasks (D-023: reverifyAll → task statuses are
+ * dropped and re-run).
  */
 export function loadExecutionFromCheckpoint(
-	pi: ExtensionAPI,
 	ctx: ExtensionContext,
 	runId: string,
 ): CheckpointExecutionLoad {
@@ -235,9 +253,6 @@ export function loadExecutionFromCheckpoint(
 		return { status: "plan-missing", error: planPath ? `plan file vanished: ${planPath}` : "checkpoint has no plan identity" };
 	}
 	const planText = fs.readFileSync(planPath, "utf8");
-	// F-002 (implementation review): the recorded plan identity is over BYTES —
-	// an in-place edit at the same path must not inherit the authorization or
-	// the verified VCs. Refuse the load and require a fresh handoff.
 	if (sha256File(planPath) !== cp.plan.sha256) {
 		return {
 			status: "plan-mismatch" as const,
@@ -246,74 +261,107 @@ export function loadExecutionFromCheckpoint(
 	}
 	const items = parseChecklist(planText);
 	if (items.length === 0) {
-		return { status: "plan-missing", error: `${planPath} has no parsable verifier checklist` };
-	}
-	const implItems = parseImplItems(planText);
-	const doneIds = new Set(cp.execution.doneVcIds);
-	// D-011/F-001: an unchanged plan digest keeps the recorded authorization;
-	// a changed HEAD under it forces re-verification of previously verified VCs.
-	// F-006 (implementation review): an approval without a resolvable HEAD
-	// recorded an unverifiable code state — re-verify instead of trusting.
+		return { status: "plan-missing", error: `${planPath} has no parsable verification checks` };
+	}
+	const planTasks = parsePlanTasks(planText);
+	if (planTasks.tasks.length === 0) {
+		return { status: "plan-missing", error: `${planPath} has no parsable tasks (## Tasks or legacy ## Implementation Items)` };
+	}
 	const headNow = resolveHeadAt(ctx.cwd);
 	const headUnverifiable = cp.execution.approval === null || cp.execution.approval.headAtApproval === null;
 	const headChanged =
 		cp.execution.approval !== null &&
 		cp.execution.approval.headAtApproval !== null &&
 		cp.execution.approval.headAtApproval !== headNow;
+	// D-023: reverifyAll re-opens every closed task (statuses dropped); a
+	// normal restore replays the persisted task progress map.
 	const reverifyAll = cp.execution.reverifyAll === true || headChanged || headUnverifiable;
+	const progress: TaskProgressMap = reverifyAll ? {} : (cp.execution.tasks ?? {});
+	const tasks = buildTaskView(planTasks, progress);
+	// v0.8: a review-cap pause SURVIVES the restore — the budget must stay
+	// bounded across restarts; only /plans-execute grants a fresh one. The
+	// legacy v0.7 prefix stays dual-matched for one release.
+	const wasReviewCapPause = isReviewCapPause(cp.execution.pausedReason);
+	// Any live round from the replaced session graph dies here (CF2-002).
+	abortInFlightReview();
 	if (!reverifyAll) {
-		for (const item of items) {
-			if (doneIds.has(item.id)) item.done = true;
+		for (const id of cp.execution.doneVcIds) {
+			const item = items.find((candidate) => candidate.id === id);
+			if (item) item.done = true;
 		}
 	}
 	execution = {
 		planPath,
 		items,
+		planTasks,
+		tasks,
+		legacyPlan: planTasks.legacy,
 		startedAt: utcNow(),
 		usage: { inToks: cp.execution.usage.inToks, outToks: cp.execution.usage.outToks },
-		implItems,
-		implStatus: { ...cp.execution.implStatus },
-		implWarning: lintImplItems(planText),
 		uiLanguage: resolveUiLanguage(ctx.cwd),
-		currentI: cp.execution.currentI,
-		goalWait: {
-			noProgressRounds: 0,
-			waitRounds: 0,
-			lastMarkers: null,
-			paused: cp.execution.pausedReason !== undefined,
-			pausedReason: cp.execution.pausedReason,
+		// D-020: a paused legacy (or stopped) execution rebuilds unpaused — the
+		// resume itself is the user's intent; the reason is surfaced in the
+		// resume brief instead. EXCEPT a review-cap pause (v0.8): it must
+		// survive restores paused and at its committed round count, or the
+		// 5-round budget would never bound anything across restarts.
+		stall: {
+			rounds: cp.execution.stallRounds ?? 0,
+			lastSnapshot: null,
+			paused: wasReviewCapPause,
+			pausedReason: wasReviewCapPause ? (cp.execution.pausedReason ?? undefined) : undefined,
 		},
+		audit: {
+			rounds: cp.execution.audit?.rounds ?? 0,
+			failed: [],
+			undeterminable: cp.execution.audit?.undeterminable ?? [],
+			running: false,
+		},
+		review: { attempts: 0, consecutiveDiscards: 0, inFlight: null },
+		auditLatch: { auditedThisSettle: false, activity: 0 },
 	};
+	execution.stall.lastSnapshot = stallSnapshot();
 	executionRunId = runId;
 	bindRun(ctx.sessionManager, ctx.cwd, runId);
-	resetGoalWaitRuntime(ctx);
-	pendingExecutionFlush = false; // restored state: no inherited flush debt
+	resetContinuationRuntime(ctx);
+	pendingExecutionFlush = false;
 	resetExecutionCompactionState(ctx);
-	// v0.6.0 orphaned-delegate detection: a restart never carries a live child.
-	// If the checkpoint/session carries delegate state, surface it so the user
-	// knows the previous executor died mid-run (VC state is intact, resumable).
-	if (cp.execution.delegate) {
+	// D-020: an orphaned v0.6.0 delegated executor never survives a restart.
+	// Its checkpoint delegate marker REFUSES the direct load — the run must
+	// re-enter through the execution handoff so the C-006 approval gate
+	// applies; execution restarts from the first task after re-approval.
+	const legacyDelegate = cp.execution.delegate !== undefined;
+	if (legacyDelegate) {
 		try {
 			ctx.ui.notify?.(
-				`pi-plans: the previous delegated executor (${cp.execution.delegate.modelSelector}) did not finish before this session ended. Verified VC state is preserved; resume with /plans-execute.`,
+				"pi-plans: this run was mid-flight under a v0.6.0 delegated executor (removed in v0.6.1). Re-approve via /plans-execute; execution restarts from the first task (the 0.6.0 progress record cannot map onto the task tree).",
 				"warning",
 			);
 		} catch {
-			/* notification is best-effort */
+			/* best-effort */
 		}
+		// Refuse the load: no execution state may activate without the fresh
+		// C-006 handoff approval.
+		execution = null;
+		executionRunId = null;
+		return {
+			status: "no-execution",
+			legacyDelegate: true,
+			error: "orphaned v0.6.0 delegated executor; re-approve via /plans-execute (execution restarts from the first task)",
+		};
 	}
 	if (headChanged) {
 		withExecutionCheckpoint(ctx, (current) => applyExecutionHeadChanged(current));
 	}
-	if (execution.goalWait) execution.goalWait.lastMarkers = goalWaitSnapshot();
-	persist(pi); // F-002: immediate session snapshot
+	persist(ctx);
 	updateStatusWidget(ctx);
 	return {
 		status: "loaded",
 		planPath,
-		doneVcIds: [...doneIds],
+		doneVcIds: [...cp.execution.doneVcIds],
 		reverifyAll,
 		pausedReason: cp.execution.pausedReason,
+		legacyPlan: planTasks.legacy,
+		legacyDelegate,
 	};
 }
 
@@ -327,7 +375,6 @@ interface ExecutionCompactionState {
 	lastSuccessfulUsagePercent: number | null;
 	lastSuccessfulAt: string | null;
 	rearmPending: boolean;
-	/** Terminal failure metadata is retained for diagnostics, not proactive retry. */
 	terminalBackoffTokens: number | null;
 	pendingStats: VccCompactionStats | null;
 	pendingFollowUpPrompt: string | null;
@@ -387,63 +434,21 @@ export function handleExecutionTurnCompaction(ctx: ExtensionContext): void {
 	consumeExecutionCompactionResumeGuard(ctx);
 }
 
-export function computeExecutionProgress(execution: ExecState): { done: number; total: number } {
-	const implItems = execution.implItems ?? [];
-	if (implItems.length) {
-		const statuses = resolveImplStatuses(implItems, execution.items, execution.implStatus);
-		const counted = implItems.filter((impl) =>
-			execution.items.some((item) => extractCoverage(item.text).includes(impl.id)),
-		);
-		const total = counted.length > 0 ? counted.length : implItems.length;
-		const vcDone = counted.filter((impl) => statuses[impl.id] === "vc-passed").length;
-		const currentIndex = execution.currentI
-			? implItems.findIndex((impl) => impl.id === execution.currentI)
-			: -1;
-		return {
-			done: Math.min(total, Math.max(vcDone, currentIndex < 0 ? 0 : currentIndex)),
-			total,
-		};
-	}
-	return {
-		done: execution.items.filter((item) => item.done).length,
-		total: execution.items.length,
-	};
-}
-
-function formatElapsed(startedAt: string): string {
-	const total = Math.max(0, Math.floor((Date.now() - Date.parse(startedAt)) / 1000));
-	const h = String(Math.floor(total / 3600)).padStart(2, "0");
-	const m = String(Math.floor((total % 3600) / 60)).padStart(2, "0");
-	const sec = String(total % 60).padStart(2, "0");
-	return `${h}:${m}:${sec}`;
-}
-
 function formatToks(tokens: number): string {
 	const n = Math.max(0, Math.round(tokens));
 	return n < 1000 ? String(n) : `${(n / 1000).toFixed(1)}k`;
 }
 
 export function formatExecutionStatusLine(execution: ExecState): string {
-	const progress = computeExecutionProgress(execution);
-	let line = `⌛ plans ${progress.done}/${progress.total}: spent ${formatElapsed(execution.startedAt)} · ${formatToks(execution.usage.inToks)} in-toks · ${formatToks(execution.usage.outToks)} out-toks`;
-	const goalWait = execution.goalWait;
-	if (goalWait?.paused) {
-		line += ` · ⏸ goal-wait paused (${goalWait.pausedReason ?? "paused"})`;
-	} else if (goalWait && (goalWait.noProgressRounds > 0 || goalWait.waitRounds > 0)) {
-		line += execChrome(execution.uiLanguage ?? "en").goalWait(goalWait.noProgressRounds, goalWait.waitRounds);
+	const progress = taskProgress(execution.tasks);
+	let line = `⌛ plans tasks ${progress.done}/${progress.total}: spent ${formatElapsed(execution.startedAt)} · ${formatToks(execution.usage.inToks)} in-toks · ${formatToks(execution.usage.outToks)} out-toks`;
+	if (execution.stall.paused) {
+		line += ` · ⏸ paused (${execution.stall.pausedReason ?? "stalled"})`;
 	}
 	return line;
 }
 
-/** Approximation for "a subprocess is pending" (matches the exec loop's
- *  `/waiting for/` backoff heuristic; F-008). Passed explicitly into the
- *  shared model so the panel, status line and injection text agree. */
-export function executionIsWaiting(execution: ExecState): boolean {
-	const gw = execution.goalWait;
-	return gw !== undefined && !gw.paused && gw.waitRounds > 0;
-}
-
-/** Resolve the run topic for panel headers (falls back to the run id). */
+/** Resolve the run topic for dashboard headers (falls back to the run id). */
 function panelTopic(ctx: ExtensionContext): string {
 	const active = resolveActiveRun(ctx.sessionManager, ctx.cwd);
 	if (active) {
@@ -454,155 +459,81 @@ function panelTopic(ctx: ExtensionContext): string {
 	return "pi-plans";
 }
 
-/** Run info for the panel activity line (CQ1/D-005). Read by the in-flight
- *  executionRunId so a stale/missing run record degrades to null (the model
- *  then falls back to the bare phase word) instead of showing another run's
- *  status. */
-function panelRunInfo(ctx: ExtensionContext): { status: string; created_at: string; updated_at: string } | null {
-	if (!executionRunId) return null;
-	// D-005 pointer-consistency: if the workdir's active pointer has moved to
-	// another run (second session / external CLI mutation) while this
-	// execution is live, the activity row degrades to the phase word rather
-	// than mixing the new active run's topic (header) with the old run's
-	// status (impl-review r1 F-001).
-	if (resolveActiveRun(ctx.sessionManager, ctx.cwd)?.run_id !== executionRunId) return null;
-	const run = getRun(ctx.cwd, executionRunId);
-	if (!run) return null;
-	return { status: run.status, created_at: run.created_at, updated_at: run.updated_at };
-}
+let dashboardRegistered = false;
+let dashboardExpanded = false;
 
-let panelRegistered = false;
-let loopPanelRegistered = false;
+/** Toggle the dashboard's expanded tree view (Ctrl+Shift+T). */
+export function toggleDashboardExpanded(ctx: ExtensionContext): void {
+	dashboardExpanded = !dashboardExpanded;
+	dashboardRegistered = false; // force re-registration with the new mode
+	updateStatusWidget(ctx);
+}
 
-/** Live implementation-review loop state for the panel: the widget stays
- * alive while the active run is done BUT its checkpoint is still in the
- * implementation-review phase (D-3). Read fresh on every call so post-write
- * redraws (index.ts turn-end updateStatusWidget) never show stale rounds
- * (D-8). Returns null once the phase flips to completed. */
-function implReviewLoopState(
-	ctx: ExtensionContext,
-): { topic: string; review: { terminationCondition?: string; reviewerCount?: number; completedRounds: number } } | null {
-	// v0.6.0: resolveActiveRun only returns NON-TERMINAL runs, but this state
-	// is by definition attached to a DONE run — fall back to the newest run of
-	// any status (display-only) when the active resolution is null.
-	const active = resolveActiveRun(ctx.sessionManager, ctx.cwd) ?? (() => {
-		const latest = latestRun(ctx.cwd);
-		return latest === null ? null : { run_id: latest.run_id, artifact_dir: latest.artifact_dir };
-	})();
-	if (!active) return null;
-	if (getRun(ctx.cwd, active.run_id)?.status !== "done") return null;
-	const load = loadCheckpoint(ctx.cwd, active.run_id);
-	if (load.status !== "ok" || load.checkpoint.phase !== "implementation-review") return null;
-	return { topic: panelTopic(ctx), review: load.checkpoint.implementationReview };
+export function isDashboardExpanded(): boolean {
+	return dashboardExpanded;
 }
 
 /**
- * Register/update the fixed tasks' status panel (aboveEditor widget) for the
- * current execution, or unregister it when execution is gone. The panel and
- * the bottom status line share the same pure model (D-003/D-014/D-015). The
- * widget uses the factory form and reads the LIVE theme via `ui.theme` inside
- * render(width) — per-line width math happens on plain text first, then the
- * current theme is applied, so theme hot-swaps and resize never produce stale
- * colors or wrapped rows (F-004).
+ * Register/update the task dashboard (aboveEditor widget) for the current
+ * execution, or unregister it when execution is gone. The compact and the
+ * expanded tree view share one widget key so they never stack.
  */
 function updatePanelWidget(ctx: ExtensionContext): void {
-	// Capability guard: older Pi hosts and test harness mocks may not expose
-	// setWidget (the panel is a UI nicety, never a correctness dependency).
 	if (!ctx.hasUI || typeof ctx.ui.setWidget !== "function") return;
-	// Implementation-review loop widget (D-3): keeps the panel alive after
-	// execution ends while the loop is live; unregisters when the phase
-	// completes. Lives under the same widget key so the two widgets never
-	// stack.
-	const loop = execution === null ? implReviewLoopState(ctx) : null;
-	if (execution === null && loop) {
-		if (!loopPanelRegistered) {
-			ctx.ui.setWidget(
-				PANEL_WIDGET_KEY,
-				(ui, _theme) => ({
-					render(width: number) {
-						const theme = (ui as { theme?: { fg(color: string, text: string): string } }).theme ?? _theme;
-						// D-8 freshness: re-read the loop state per render; a phase flip to
-						// completed renders an empty box until the next turn-end refresh
-						// unregisters it (index.ts always calls updateStatusWidget then).
-						const live = implReviewLoopState(ctx);
-						if (!live) return [];
-						const model = deriveImplReviewLoopModel(live.topic, live.review);
-						const lines = renderImplReviewLoopLines(model, width);
-						return theme ? themeImplReviewLoopLines(lines, theme as never) : lines;
-					},
-				}),
-				{ placement: "aboveEditor" },
-			);
-			loopPanelRegistered = true;
-		}
-	} else if (loopPanelRegistered) {
-		ctx.ui.setWidget(PANEL_WIDGET_KEY, undefined);
-		loopPanelRegistered = false;
-	}
 	if (!execution) {
-		if (panelRegistered) {
-			ctx.ui.setWidget(PANEL_WIDGET_KEY, undefined);
-			panelRegistered = false;
+		if (dashboardRegistered) {
+			ctx.ui.setWidget(DASHBOARD_WIDGET_KEY, undefined);
+			dashboardRegistered = false;
 		}
 		return;
 	}
-	if (!panelRegistered) {
-		ctx.ui.setWidget(
-			PANEL_WIDGET_KEY,
-			(ui, _theme) => ({
-				render(width: number) {
-					const theme = (ui as { theme?: { fg(color: string, text: string): string } }).theme ?? _theme;
-					const current = execution;
-					if (!current) return [];
-					// F-004 (impl review r1): recompute the topic per render so a
-					// cross-run restart without an intervening unregister cannot
-					// show a stale box header.
-					const model = derivePanelModel(current, panelTopic(ctx), executionIsWaiting(current), panelRunInfo(ctx));
-					const lines = renderPanelLines(model, width);
-					// Uniform-gray frame: │ borders never inherit the line color;
-					// accents live between the borders only (themePanelLines).
-					return theme ? themePanelLines(lines, model, theme) : lines;
-				},
-			}),
-			{ placement: "aboveEditor" },
-		);
-		panelRegistered = true;
-	} else {
-		// Factory components are re-created on every registration; content
-		// updates flow through the closure reads at render time, so a no-op
-		// re-set is unnecessary. Trigger one re-render via a cheap status
-		// touch is NOT used — event-driven flush only (D-013).
-	}
+	if (dashboardRegistered) return;
+	ctx.ui.setWidget(
+		DASHBOARD_WIDGET_KEY,
+		(ui, _theme) => ({
+			render(width: number) {
+				const theme = (ui as { theme?: { fg(color: string, text: string): string } }).theme ?? _theme;
+				const current = execution;
+				if (!current) return [];
+				const model = deriveDashboardModel(panelTopic(ctx), current.tasks, current.items, {
+					paused: current.stall.paused,
+					pausedReason: current.stall.pausedReason,
+					auditRounds: current.audit.rounds > 0 || current.audit.running ? current.audit.rounds : null,
+					auditFailed: current.audit.failed,
+					auditUndeterminable: current.audit.undeterminable,
+					reviewRunning: current.audit.running === true || current.review.inFlight !== null,
+					startedAt: current.startedAt,
+					usage: current.usage,
+				});
+				const lines = dashboardExpanded
+					? renderDashboardTreeLines(model, width, theme)
+					: renderDashboardLines(model, width, theme);
+				return lines;
+			},
+		}),
+		{ placement: "aboveEditor" },
+	);
+	dashboardRegistered = true;
 }
 
 export function updateStatusWidget(ctx: ExtensionContext): void {
 	updatePanelWidget(ctx);
-	if (execution) {
-		// D-015: the status line derives from the same panel model.
-		const line = formatPanelSummaryLine(
-			derivePanelModel(execution, panelTopic(ctx), executionIsWaiting(execution), panelRunInfo(ctx)),
-		);
-		ctx.ui.setStatus("pi-plans", ctx.ui.theme.fg("accent", line));
+	if (execution && typeof ctx.ui.setStatus === "function" && ctx.ui.theme) {
+		const model = deriveDashboardModel(panelTopic(ctx), execution.tasks, execution.items, {
+			paused: execution.stall.paused,
+			pausedReason: execution.stall.pausedReason,
+			auditRounds: execution.audit.rounds > 0 ? execution.audit.rounds : null,
+			auditFailed: execution.audit.failed,
+			auditUndeterminable: execution.audit.undeterminable,
+			reviewRunning: execution.audit.running === true || execution.review.inFlight !== null,
+		});
+		ctx.ui.setStatus("pi-plans", ctx.ui.theme.fg("accent", formatDashboardSummaryLine(model)));
 		return;
 	}
 	const active = resolveActiveRun(ctx.sessionManager, ctx.cwd);
-	if (active) {
-		// Idle indicator depends on the run's lifecycle, not just its existence:
-		// done reads as finished, abandoned as closed, stopped/accepted as paused.
-		// v0.6.0: resolveActiveRun only returns NON-TERMINAL runs; for the pure
-		// display line below, fall back to the newest run of any status so a
-		// finished workdir still shows its last run's outcome.
+	if (active && typeof ctx.ui.setStatus === "function" && ctx.ui.theme) {
 		const status = getRun(ctx.cwd, active.run_id)?.status ?? latestRun(ctx.cwd)?.status;
 		if (status === "done") {
-			// D-3/D-015: while the implementation-review loop is live (checkpoint
-			// still in the implementation-review phase), the status line mirrors
-			// the loop box model instead of a bare "(done)".
-			const loop = implReviewLoopState(ctx);
-			if (loop) {
-				const line = formatImplReviewLoopSummaryLine(deriveImplReviewLoopModel(loop.topic, loop.review));
-				ctx.ui.setStatus("pi-plans", ctx.ui.theme.fg("accent", line));
-				return;
-			}
 			ctx.ui.setStatus("pi-plans", ctx.ui.theme.fg("success", `🎯 plans: ${active.run_id} (done)`));
 			return;
 		}
@@ -618,63 +549,67 @@ export function updateStatusWidget(ctx: ExtensionContext): void {
 			ctx.ui.setStatus("pi-plans", ctx.ui.theme.fg("warning", `⌛ plans: ${active.run_id}`));
 			return;
 		}
+		if (status === "executing") {
+			ctx.ui.setStatus("pi-plans", ctx.ui.theme.fg("accent", `⌛ plans: ${active.run_id} (executing)`));
+			return;
+		}
+		if (status === "verifying") {
+			ctx.ui.setStatus("pi-plans", ctx.ui.theme.fg("accent", `🔎 plans: ${active.run_id} (verifying)`));
+			return;
+		}
 		if (status === "planning") {
-			// Planning phase: 💬 while still in Q&A, 📝 once a PLAN draft exists
-			// — kept until execution starts (then ⌛ takes over).
-			const emoji = latestPlanVersion(active.artifact_dir) ? "📝" : "💬";
+			const emoji = parseLatestPlanExists(active.artifact_dir) ? "📝" : "💬";
 			ctx.ui.setStatus("pi-plans", ctx.ui.theme.fg("muted", `${emoji} plans: ${active.run_id}`));
 			return;
 		}
-		// unknown status: no indicator.
-	}
-	// Terminal-only workdir: resolveActiveRun is null, but the display line
-	// still reports the newest run's outcome (done/abandoned, plus its live
-	// implementation-review loop).
-	const terminalLatest = latestRun(ctx.cwd);
-	if (terminalLatest && TERMINAL_RUN_STATUSES.has(terminalLatest.status)) {
-		if (terminalLatest.status === "done") {
-			const loop = implReviewLoopState(ctx);
-			if (loop) {
-				const line = formatImplReviewLoopSummaryLine(deriveImplReviewLoopModel(loop.topic, loop.review));
-				ctx.ui.setStatus("pi-plans", ctx.ui.theme.fg("accent", line));
-				return;
+	}
+	if (typeof ctx.ui?.setStatus === "function" && ctx.ui.theme) {
+		const terminalLatest = latestRun(ctx.cwd);
+		if (terminalLatest && TERMINAL_RUN_STATUSES.has(terminalLatest.status)) {
+			if (terminalLatest.status === "done") {
+				ctx.ui.setStatus("pi-plans", ctx.ui.theme.fg("success", `🎯 plans: ${terminalLatest.run_id} (done)`));
+			} else {
+				ctx.ui.setStatus("pi-plans", ctx.ui.theme.fg("error", `🚫 plans: ${terminalLatest.run_id}`));
 			}
-			ctx.ui.setStatus("pi-plans", ctx.ui.theme.fg("success", `🎯 plans: ${terminalLatest.run_id} (done)`));
-		} else {
-			ctx.ui.setStatus("pi-plans", ctx.ui.theme.fg("error", `🚫 plans: ${terminalLatest.run_id}`));
+			return;
 		}
-		return;
+		ctx.ui.setStatus("pi-plans", undefined);
 	}
-	ctx.ui.setStatus("pi-plans", undefined);
 }
 
-function persist(pi: ExtensionAPI): void {
+function parseLatestPlanExists(artifactDir: string): boolean {
+	try {
+		const names = fs.readdirSync(artifactDir);
+		return names.some((name) => /^PLAN_v\d+\.(md|markdown)$/i.test(name));
+	} catch {
+		return false;
+	}
+}
+
+function persist(ctx: ExtensionContext): void {
 	if (!execution) return;
-	pi.appendEntry("pi-plans-exec", {
+	messaging().appendEntry("pi-plans-exec", {
 		planPath: execution.planPath,
 		items: execution.items,
+		planTasks: execution.planTasks,
+		tasks: execution.tasks,
+		legacyPlan: execution.legacyPlan,
 		startedAt: execution.startedAt,
 		usage: execution.usage,
-		implItems: execution.implItems,
-		implStatus: execution.implStatus,
-		implWarning: execution.implWarning ?? null,
-		currentI: execution.currentI,
-		goalWait: execution.goalWait,
-		delegate: execution.delegate ?? null,
+		stall: execution.stall,
+		audit: { rounds: execution.audit.rounds, failed: execution.audit.failed },
 	});
 }
 
 /** Checkpoint bookkeeping for the executing run; best-effort for legacy runs
- * without checkpoints (their cross-session resume degrades to R-008 rules). */
-function withExecutionCheckpoint(ctx: ExtensionContext, mutator: (cp: import("./workflow-state.ts").WorkflowCheckpoint) => import("./workflow-state.ts").WorkflowCheckpoint): void {
+ * without checkpoints. */
+function withExecutionCheckpoint(ctx: ExtensionContext, mutator: (cp: WorkflowCheckpoint) => WorkflowCheckpoint): void {
 	if (!execution) return;
 	const active = resolveActiveRun(ctx.sessionManager, ctx.cwd);
 	if (!active || active.run_id !== executionRunId) return;
 	try {
 		mutateCheckpoint(ctx.cwd, active.run_id, mutator);
 	} catch (error) {
-		// F-005 (implementation review): ownership loss and revision staleness
-		// must stop the advance, not vanish into the catch block.
 		if (error instanceof OwnershipError || error instanceof StaleCheckpointError) throw error;
 		/* legacy run or corrupt checkpoint: session snapshot still carries the loop */
 	}
@@ -682,284 +617,109 @@ function withExecutionCheckpoint(ctx: ExtensionContext, mutator: (cp: import("./
 
 let executionRunId: string | null = null;
 
+export interface StartExecutionInput {
+	planPath: string;
+	planTasks: PlanTasks;
+	items: CheckItem[];
+}
+
 export async function startExecution(
-	pi: ExtensionAPI,
 	ctx: ExtensionContext,
-	planPath: string,
-	items: CheckItem[],
-	implItems?: ImplItem[],
-	opts?: StartExecutionOptions,
+	input: StartExecutionInput,
 ): Promise<void> {
+	// A fresh handoff replaces any live run — abort its in-flight review round first.
+	abortInFlightReview();
+	const tasks = buildTaskView(input.planTasks);
 	execution = {
-		planPath,
-		items,
+		planPath: input.planPath,
+		items: input.items,
+		planTasks: input.planTasks,
+		tasks,
+		legacyPlan: input.planTasks.legacy,
 		startedAt: utcNow(),
 		usage: { inToks: 0, outToks: 0 },
-		implItems: implItems ?? [],
-		implStatus: {},
 		uiLanguage: resolveUiLanguage(ctx.cwd),
-		// F-001 (impl review r1): derive the plan-lint warning on the live
-		// handoff path too, so the panel shows the ⚠ line immediately for a
-		// zero-parse section instead of only after a checkpoint restore.
-		implWarning: (() => {
-			try {
-				return lintImplItems(fs.readFileSync(planPath, "utf8"));
-			} catch {
-				return null;
-			}
-		})(),
-		goalWait: { noProgressRounds: 0, waitRounds: 0, lastMarkers: null, paused: false },
+		stall: { rounds: 0, lastSnapshot: null, paused: false },
+		audit: { rounds: 0, failed: [], undeterminable: [], running: false },
+		review: { attempts: 0, consecutiveDiscards: 0, inFlight: null },
+		auditLatch: { auditedThisSettle: false, activity: 0 },
 	};
-	// Seed the marker baseline so the first quiet round is counted against a
-	// real snapshot instead of counting unconditionally (F-006).
-	if (execution.goalWait) execution.goalWait.lastMarkers = goalWaitSnapshot();
-	resetGoalWaitRuntime(ctx);
-	pendingExecutionFlush = false; // fresh run: no inherited flush debt
+	// Seed the watchdog baseline only after `execution` points at the new state
+	// (stallSnapshot reads the live execution).
+	execution.stall.lastSnapshot = stallSnapshot();
+	resetContinuationRuntime(ctx);
+	pendingExecutionFlush = false;
 	resetExecutionCompactionState(ctx);
-	persist(pi);
+	persist(ctx);
 	const active = resolveActiveRun(ctx.sessionManager, ctx.cwd);
 	executionRunId = active?.run_id ?? null;
 	if (active) {
 		bindRun(ctx.sessionManager, ctx.cwd, active.run_id);
-		// I-005: durable approval evidence — run + plan digest + HEAD at
-		// approval (D-003/D-011). Sets phase executing via the state machine.
 		try {
 			const load = loadCheckpoint(ctx.cwd, active.run_id);
 			if (load.status === "missing") {
 				createCheckpoint(ctx.cwd, { runId: active.run_id, originWorkdir: ctx.cwd, workdir: ctx.cwd });
 			}
 			const approval: ExecutionApproval = {
-				plan: planIdentityOf(path.resolve(planPath), 1),
+				plan: planIdentityOf(path.resolve(input.planPath), 1),
 				worktree: resolveWorktreeRoot(ctx.cwd) ?? path.resolve(ctx.cwd),
 				headAtApproval: resolveHeadAt(ctx.cwd),
 				approvedAt: utcNow(),
 			};
 			mutateCheckpoint(ctx.cwd, active.run_id, (cp) => {
-				// Plan refinement may not have recorded the plan identity yet.
 				const withPlan = cp.plan === null ? { ...cp, plan: approval.plan } : cp;
-				// The checkpoint may not carry accept-execute (legacy flow);
-				// approval here came from the explicit handoff confirmation.
 				const aligned = withPlan.nextAction === "accept-execute"
 					? withPlan
 					: { ...withPlan, nextAction: "accept-execute" as const };
 				return applyExecutionApproved(aligned, approval);
 			});
-			// Plan-lint entry point (execute handoff): a plan whose Implementation
-			// Items section parses to zero items gets a durable run notice so the
-			// execution panel's warning is backed by persisted evidence.
-			lintPlanIntoNotices(ctx.cwd, active.run_id, path.resolve(planPath));
+			lintPlanIntoNotices(ctx.cwd, active.run_id, path.resolve(input.planPath));
 		} catch (error) {
-			// F-002 (implementation review): a plan-digest mismatch between the
-			// recorded checkpoint plan and the approval must fail closed and
-			// visibly — never silently execute without durable approval.
 			if (error instanceof StateError && /does not match/.test(error.message)) throw error;
 			/* legacy/corrupt checkpoint: run status still transitions below */
 		}
 		try {
 			setRunStatus(ctx.cwd, active.run_id, "executing");
 		} catch {
-			/* status bookkeeping is best-effort */
+			/* best-effort */
 		}
 	}
-	pi.sendMessage(
+	const progress = taskProgress(tasks);
+	messaging().sendMessage(
 		{
 			customType: "pi-plans-exec-start",
-			content: `**pi-plans: executing** \`${planPath}\` — ${items.length} verifier item(s). Progress appears in the bottom status bar; mark verified items with \`[DONE:VC-xxx]\`.`,
+			content: `**pi-plans: executing** \`${input.planPath}\` — ${progress.total} task(s) in ${input.planTasks.legacy ? "legacy" : "task-tree"} mode, ${input.items.length} verification check(s). Report progress with the \`plans_update_task\` tool; the dashboard tracks every task (Ctrl+Shift+T expands the tree).`,
 			display: true,
 		},
 		{ triggerTurn: false },
 	);
-	// Delegated runtime (v0.6.0): one executor child implements the whole plan
-	// while this tool call blocks; the parent mirrors VC progress from the
-	// child's streamed assistant messages (R-9..R-12).
 	updateStatusWidget(ctx);
-	if (opts?.runtime && opts.runtime !== "current-session") {
-		await runDelegatedExecution(pi, ctx, opts.runtime.modelSelector, opts.signal);
-	}
-}
-
-/** Where a chosen execution runs: this session, or a delegated executor child. */
-export type ExecutionRuntime = "current-session" | { modelSelector: string };
-
-export interface StartExecutionOptions {
-	/** "current-session" (default) or a delegated executor model selector. */
-	runtime?: ExecutionRuntime;
-	/** Tool-call abort signal, threaded into the delegated child. */
-	signal?: AbortSignal;
-}
-
-/** Default delegated executor timeout when config omits executor_timeout_minutes. */
-const DELEGATE_DEFAULT_TIMEOUT_MINUTES = 60;
-void DELEGATE_DEFAULT_TIMEOUT_MINUTES;
-
-/** Live AbortController for the delegated executor child (runtime-only state). */
-let delegatedRuntime: AbortController | null = null;
-
-/** Abort the delegated executor child, if one is running (used by /plans-stop). */
-export function abortDelegatedExecutor(): boolean {
-	if (delegatedRuntime === null) return false;
-	delegatedRuntime.abort();
-	return true;
-}
-
-function executorAgentPrompt(): string {
-	try {
-		const agentPath = new URL("../agents/executor.md", import.meta.url);
-		return fs.readFileSync(agentPath, "utf8");
-	} catch {
-		return "You are a delegated plan executor in the pi-plans workflow. Implement the accepted plan autonomously and emit [DONE:VC-xxx] markers in your replies as verifier items pass.";
-	}
 }
 
-function delegatedExecutorTimeoutMs(): number | undefined {
-	try {
-		const stateRoot = resolveStateRootOrNull(process.cwd());
-		if (stateRoot === null) return undefined;
-		const minutes = loadConfig(stateRoot).executor_timeout_minutes;
-		if (typeof minutes !== "number" || minutes <= 0) return undefined;
-		return minutes * 60 * 1000;
-	} catch {
-		return undefined;
-	}
-}
-
-/**
- * Delegated execution (R-9..R-12): spawn ONE executor child for the whole
- * plan (write-capable tools, chosen model, PI_PLANS_EXECUTOR=1 + pinned run
- * id), stream its progress into the overlay, parse full-text assistant
- * messages for [DONE:VC-xxx]/[I-xxx] markers, and on exit verify the
- * remaining items. Abort/timeout → stopExecution (stopped, resumable);
- * clean exit with items left → stay executing (resumable under either
- * runtime); clean exit complete → normal completion flow.
- */
-async function runDelegatedExecution(
-	pi: ExtensionAPI,
-	ctx: ExtensionContext,
-	modelSelector: string,
-	parentSignal: AbortSignal | undefined,
-): Promise<void> {
+/** Persist the live task progress (called by the task status tool). */
+export function persistTaskProgress(ctx: ExtensionContext): void {
 	if (!execution) return;
-	const controller = new AbortController();
-	delegatedRuntime = controller;
-	const relayAbort = () => controller.abort();
-	if (parentSignal?.aborted) controller.abort();
-	else parentSignal?.addEventListener("abort", relayAbort, { once: true });
-	const lang = resolveUiLanguage(ctx.cwd);
-	const overlay = ctx.mode === "tui" ? new RefineOverlayController("executor", [{ id: "executor" }], relayAbort, lang) : undefined;
-	if (overlay) {
-		try {
-			overlay.open(refineOverlayContext(ctx), modelSelector);
-		} catch {
-			/* overlay is best-effort; the blocking call itself must not fail */
-		}
-	}
-	execution.delegate = { modelSelector, startedAt: utcNow() };
-	withExecutionCheckpoint(ctx, (cp) => applyExecutionProgress(cp, { delegate: execution?.delegate ?? null }));
-	persist(pi);
-	const runId = executionRunId;
-	const remainingAtStart = execution.items.filter((item) => !item.done).map((item) => item.id);
-	const task = [
-		`Implement the accepted plan at ${execution.planPath} (workdir: ${ctx.cwd}).`,
-		"Read the plan file first; it is the source of truth for scope, sequencing, and verification steps.",
-		remainingAtStart.length > 0
-			? `Verifier items still open: ${remainingAtStart.join(", ")}. Emit [DONE:VC-xxx] markers in your replies as each item's stated evidence passes.`
-			: "All verifier items already passed; verify the plan end-to-end and report.",
-		execution.implItems?.length
-			? `Implementation items: ${execution.implItems.map((item) => item.id).join(", ")} — emit [I-###:implemented]/[I-###:validating] markers as you progress.`
-			: "",
-		"Finish with the structured summary your system prompt specifies.",
-	]
-		.filter((line) => line !== "")
-		.join("\n");
-	let result: Awaited<ReturnType<typeof runPiSubagent>>;
-	try {
-		result = await runPiSubagent({
-			systemPrompt: executorAgentPrompt(),
-			task,
-			cwd: ctx.cwd,
-			model: modelSelector,
-			tools: ["read", "write", "edit", "bash", "grep", "find", "ls"],
-			envMarker: "executor",
-			runId: runId ?? undefined,
-			signal: controller.signal,
-			timeoutMs: delegatedExecutorTimeoutMs(),
-			onProgress: (event: SubagentProgressEvent) => {
-				try {
-					overlay?.update("executor", event);
-			} catch {
-				/* display must not fail the child runner */
-			}
-			if (
-					event.type === "transcript"
-					&& event.phase === "end"
-					&& event.entryType === "assistant-text"
-					&& typeof event.text === "string"
-			) {
-					mirrorDelegateMarkers(pi, ctx, event.text);
-			}
+	// Any task-state change resets the stall watchdog baseline.
+	execution.stall.rounds = 0;
+	execution.stall.lastSnapshot = stallSnapshot();
+	withExecutionCheckpoint(ctx, (cp) =>
+		applyExecutionProgress(cp, {
+			tasks: taskProgressMap(execution!.tasks),
+			doneVcIds: execution!.items.filter((item) => item.done).map((item) => item.id),
+			stallRounds: execution!.stall.rounds,
+			audit: {
+				rounds: execution!.audit.rounds,
+				lastResult: execution!.audit.failed.length > 0 ? execution!.audit.failed.join(",") : undefined,
+				undeterminable: execution!.audit.undeterminable.length > 0 ? execution!.audit.undeterminable : undefined,
 			},
-		});
-	} finally {
-		delegatedRuntime = null;
-		try {
-			await overlay?.close();
-		} catch {
-			/* best-effort */
-		}
-		parentSignal?.removeEventListener("abort", relayAbort);
-	}
-	if (!result.ok) {
-		const reason = result.timedOut
-			? `delegated executor timed out (${result.errorMessage ?? "no output"})`
-			: result.cancelled || controller.signal.aborted
-				? "delegated executor aborted by user"
-				: `delegated executor failed: ${result.errorMessage ?? "unknown error"}${result.stderr ? `; stderr: ${result.stderr.slice(0, 500)}` : ""}`;
-		await stopExecution(pi, ctx, reason);
-		return;
-	}
-	// Clean exit: land any markers from the final output text, then verify.
-	mirrorDelegateMarkers(pi, ctx, result.output);
-	if (isExecutionComplete()) {
-		await completeExecution(pi, ctx);
-		return;
-	}
-	// Items remain: keep the run executing (resumable via /plans-execute under
-	// either runtime); the delegate bookkeeping is cleared so restarts do not
-	// treat this as an orphaned child.
-	if (execution) {
-		execution.delegate = undefined;
-		withExecutionCheckpoint(ctx, (cp) => applyExecutionProgress(cp, { delegate: null }));
-		persist(pi);
-	}
-	const remaining = execution?.items.filter((item) => !item.done).map((item) => item.id) ?? [];
-	pi.sendMessage(
-		{
-			customType: "pi-plans-exec-delegate-exit",
-			content: `**pi-plans: delegated executor exited with items remaining** — ${remaining.join(", ") || "(none)"}. Run stays executing; resume with /plans-execute (either runtime). Executor summary:\n${result.output.slice(0, 2000)}`,
-			display: true,
-		},
-		{ triggerTurn: false },
+		}),
 	);
-	ctx.ui.notify?.(`Delegated executor exited; ${remaining.length} verifier item(s) remain. Resume with /plans-execute.`, "warning");
-	updateStatusWidget(ctx);
+	persist(ctx);
 }
 
-/** Apply VC/I markers parsed from a delegated child's full-text message. Exported for tests. */
-export function mirrorDelegateMarkers(pi: ExtensionAPI, ctx: ExtensionContext, text: string): void {
-	const changedVc = applyDoneMarkers(text);
-	const changedImpl = applyImplMarkers(text);
-	applyCurrentIMarker(text);
-	if (changedVc.length === 0 && changedImpl.length === 0) return;
-	withExecutionCheckpoint(ctx, (cp) => applyExecutionProgress(cp));
-	persist(pi);
-	updateStatusWidget(ctx);
-}
-
-/** Record one assistant turn: accumulate usage and mark any completed items. */
+/** Record one assistant turn: accumulate usage only (markers are gone). */
 export function recordExecutionTurn(
-	pi: ExtensionAPI,
-	_ctx: ExtensionContext,
-	_completedIds: string[],
+	ctx: ExtensionContext,
 	usage?: { input: number; output: number },
 ): void {
 	if (!execution) return;
@@ -967,102 +727,645 @@ export function recordExecutionTurn(
 		execution.usage.inToks += usage.input;
 		execution.usage.outToks += usage.output;
 	}
-	// I-005: mirror progress into the run checkpoint so a different session
-	// can resume with the verified VC/I set (R-004).
-	withExecutionCheckpoint(_ctx, (cp) =>
+	withExecutionCheckpoint(ctx, (cp) =>
 		applyExecutionProgress(cp, {
-			doneVcIds: execution!.items.filter((item) => item.done).map((item) => item.id),
-			implStatus: implStatusSnapshot(),
-			currentI: execution!.currentI,
 			usage: usage ? { inToks: usage.input, outToks: usage.output } : undefined,
 		}),
 	);
-	requestExecutionFlush(pi, _ctx);
-	updateStatusWidget(_ctx);
+	requestExecutionFlush();
+	updateStatusWidget(ctx);
 }
 
-function implStatusSnapshot(): Record<string, string> {
-	const snapshot: Record<string, string> = {};
-	if (!execution?.implItems) return snapshot;
-	for (const item of execution.implItems) {
-		const state = execution.implStatus?.[item.id];
-		if (state) snapshot[item.id] = state;
-	}
-	return snapshot;
+/** Test hook: replace the audit subagent with a deterministic function. */
+let auditRunnerForTests: ((input: { planPath: string; checklist: CheckItem[]; tasks: TaskView[]; round: number }) => Promise<Awaited<ReturnType<typeof runCompletionAudit>>>) | null = null;
+
+export function __setAuditRunnerForTests(
+	runner: ((input: { planPath: string; checklist: CheckItem[]; tasks: TaskView[]; round: number }) => Promise<Awaited<ReturnType<typeof runCompletionAudit>>>) | null,
+): void {
+	auditRunnerForTests = runner;
 }
 
 export function registerExecutionTurnHandlers(
-	pi: ExtensionAPI,
+	ext: ExtensionAPI,
 	onTurnEnd?: (ctx: ExtensionContext) => Promise<void> | void,
 ): void {
-	// The turn_end projection does not carry usage; message_end delivers the
-	// full assistant message, so cache it here and consume it per turn.
 	let lastAssistantUsage: { input: number; output: number } | null = null;
-	pi.on("agent_start", async (_event, ctx) => {
-		const runtime = currentGoalWaitRuntime(ctx);
+	ext.on("agent_start", async (_event, ctx) => {
+		const runtime = currentContinuationRuntime(ctx);
 		if (!runtime) return;
 		runtime.handled = false;
 		runtime.stopReason = undefined;
-		runtime.text = "";
+		// v0.7.1: a new agent run opens a new settle window (per-settle latch).
+		if (execution) resetSettleLatch();
 	});
-	pi.on("before_agent_start", async (_event, ctx) => {
-		const runtime = currentGoalWaitRuntime(ctx);
+	ext.on("before_agent_start", async (_event, ctx) => {
+		const runtime = currentContinuationRuntime(ctx);
 		if (runtime) runtime.wakeId = undefined;
 	});
-	pi.on("input", async (event, ctx) => {
-		if (event.source === "interactive" || event.source === "rpc") resumeGoalWaitIfPaused(pi, ctx);
+	ext.on("input", async (event, ctx) => {
+		if (event.source === "interactive" || event.source === "rpc") resumeGoalWaitIfPaused(ctx);
 	});
-	pi.on("agent_settled", async (_event, ctx) => {
-		drainExecutionFlush(pi, ctx);
-		maybeGoalWaitFollowUp(pi, ctx);
+	ext.on("agent_settled", async (_event, ctx) => {
+		drainExecutionFlush(ctx);
+		maybeContinuationFollowUp(ctx);
 	});
-	pi.on("session_shutdown", async (_event, ctx) => {
-		drainExecutionFlush(pi, ctx);
+	// v0.7.1: `agent_settled` is notification-only per pi's contract, so the
+	// audit fallback lives on `agent_before_settle` — the final ACTIONABLE
+	// boundary. It is what makes a terminal-but-unaudited run self-heal with
+	// zero user input, instead of stranding until a manual /plans-execute.
+	ext.on("agent_before_settle", async (_event, ctx) => {
+		if (!pendingAudit()) return;
+		const runtime = currentContinuationRuntime(ctx);
+		if (runtime?.handled) return;
+		// The continuation wake owns this settle: if the loop already woke the
+		// agent to fix rolled-back work, the audit waits for the next settle
+		// (Q-2 single-wake guarantee) rather than emitting a second wake.
+		if (runtime && !allTasksTerminal(runtime.owner.tasks)) {
+			maybeContinuationFollowUp(ctx);
+			return;
+		}
+		// Fully settled and still owed a review: launch the round under the
+		// mode rule — tui/rpc detach (the settle returns NOW and the overlay
+		// carries progress); print/json await inline so runtime teardown cannot
+		// kill the child. The round's own outcome routing drives the rest.
+		latchAuditThisSettle();
+		const chain = launchReviewRound(ctx);
+		if (chain) await chain;
+	});
+	ext.on("session_shutdown", async (_event, ctx) => {
+		drainExecutionFlush(ctx);
+		abortInFlightReview();
 		execution = null;
 		executionRunId = null;
-		goalWaitRuntime = null;
+		continuationRuntime = null;
 		lastAssistantUsage = null;
 	});
-	pi.on("message_end", async (event) => {
+	ext.on("message_end", async (event) => {
 		const message = event.message as { role?: string; usage?: { input?: number; output?: number } };
 		if (message?.role === "assistant" && message.usage) {
 			lastAssistantUsage = { input: message.usage.input ?? 0, output: message.usage.output ?? 0 };
 		}
 	});
+	// v0.7.1 (root cause B): the stall watchdog counted only task-status changes,
+	// so a round where the agent legitimately investigated (read code, gathered
+	// evidence) without closing a task looked identical to a dead agent. A
+	// SUCCESSFUL tool result is real progress; a failed/blocked tool is not, so
+	// an agent looping on the same error still trips the cap (F-005, Q-3).
+	ext.on("tool_result", async (event, _ctx) => {
+		if (!execution) return;
+		const result = event as { isError?: boolean; error?: unknown };
+		if (result.isError === true || result.error !== undefined) return;
+		auditLatchOf(execution).activity += 1;		// Real progress: rebase the watchdog so this round counts as a change.
+		execution.stall.rounds = 0;
+		execution.stall.lastSnapshot = stallSnapshot();
+	});
 
-	pi.on("turn_end", async (event, ctx) => {
-		const message = event.message as { role?: string; stopReason?: string; content?: Array<{ type: string; text?: string }> };
+	ext.on("turn_end", async (event, ctx) => {
+		const message = event.message as { role?: string; stopReason?: string };
 		if (!message || message.role !== "assistant") {
 			updateStatusWidget(ctx);
 			return;
 		}
-		const text = (message.content ?? [])
-			.filter((part) => part.type === "text")
-			.map((part) => part.text ?? "")
-			.join("\n");
-		const runtime = currentGoalWaitRuntime(ctx);
-		if (runtime) {
-			runtime.stopReason = message.stopReason;
-			runtime.text = text;
-		}
-		const changedIds = applyDoneMarkers(text);
-		const changedImpls = applyImplMarkers(text);
-		const changedCurrentI = applyCurrentIMarker(text);
+		const runtime = currentContinuationRuntime(ctx);
+		if (runtime) runtime.stopReason = message.stopReason;
 		const projection = (event.message as { usage?: { input?: number; output?: number } }).usage;
 		const raw = projection ?? lastAssistantUsage;
-		lastAssistantUsage = null; // consumed: never re-attribute a stale turn
+		lastAssistantUsage = null;
 		const usage = raw ? { input: raw.input ?? 0, output: raw.output ?? 0 } : undefined;
-		if (usage || changedIds.length > 0 || changedImpls.length > 0 || changedCurrentI) {
-			// Attribute this turn's usage now; `[DONE]` markers still only mark completion.
-			recordExecutionTurn(pi, ctx, changedIds, usage);
-		}
-		if (getExecution() && isExecutionComplete()) {
-			await completeExecution(pi, ctx);
+		if (usage) recordExecutionTurn(ctx, usage);
+		if (getExecution() && pendingAudit() && !auditLatchOf(execution!).auditedThisSettle) {
+			latchAuditThisSettle();
+			const chain = launchReviewRound(ctx);
+			if (chain) await chain;
 		}
 		await onTurnEnd?.(ctx);
 	});
 }
 
+/** ==== Execution-review loop (v0.8) ====
+ *
+ *  When every task is terminal and checks are still owed, the run enters the
+ *  `verifying` status and a DETACHED read-only reviewer round runs in the
+ *  background (tui/rpc): the settle handler returns immediately and the
+ *  executor is truly idle while the overlay shows live progress. In print/json
+ *  modes the settle handler keeps AWAITING the round inline — runtime
+ *  teardown at settle would otherwise kill a detached child and swallow the
+ *  pause signal.
+ *
+ *  Budget: `audit.rounds` counts COMMITTED rounds only (pass, fail, or
+ *  undeterminable); discards and cancellations burn nothing. Undeterminable
+ *  rounds self-schedule the retry inside the loop (no wake). Two consecutive
+ *  fingerprint discards commit as an undeterminable round so the loop stays
+ *  bounded. Exhaustion pauses in EVERY mode (fail-closed) with an in-band
+ *  `pi-plans-review-paused` message; the ONLY fresh-budget surface is
+ *  /plans-execute — ordinary input and session restores never refill.
+ *
+ *  Lifecycle: each round owns a session-scoped AbortController (never
+ *  ctx.signal, which is turn-scoped), aborted from session_shutdown,
+ *  stopExecution, startExecution, and restoreFromSession. Outcomes are
+ *  guarded by execution identity (`execution !== owner` → silent discard).
+ *
+ *  Completion stays fail-closed AND never fail-open: a run completes only
+ *  when every pending check was affirmatively passed. */
+const REVIEW_CAP_PAUSE_PREFIX = "execution review exhausted";
+/** v0.7 protocol value — dual-matched for one release so checkpoints written
+ * by older builds keep their cap pause recognized on restore. */
+const LEGACY_AUDIT_CAP_PAUSE_PREFIX = "completion audit exhausted";
+
+function isReviewCapPause(reason: string | undefined | null): boolean {
+	if (!reason) return false;
+	return reason.startsWith(REVIEW_CAP_PAUSE_PREFIX) || reason.startsWith(LEGACY_AUDIT_CAP_PAUSE_PREFIX);
+}
+
+/** The currently-running (or self-scheduling) review chain; the sanctioned
+ * test seam awaits this. */
+let activeReviewChain: Promise<void> | null = null;
+
+function abortInFlightReview(): void {
+	const inFlight = execution?.review.inFlight;
+	if (inFlight) {
+		try {
+			inFlight.controller.abort();
+		} catch {
+			/* already aborted */
+		}
+		if (execution) execution.review.inFlight = null;
+	}
+	activeReviewChain = null;
+}
+
+function reviewOwed(ex: ExecState): boolean {
+	return allTasksTerminal(ex.tasks) && auditableChecks(ex.items, ex.tasks).some((item) => !item.done);
+}
+
+function runDirOf(ctx: ExtensionContext): string | null {
+	const runId = executionRunId ?? resolveActiveRun(ctx.sessionManager, ctx.cwd)?.run_id ?? null;
+	return runId ? runDirPath(ctx.cwd, runId) : null;
+}
+
+function setRunStatusForReview(ctx: ExtensionContext, status: "verifying" | "executing"): void {
+	const runId = executionRunId ?? resolveActiveRun(ctx.sessionManager, ctx.cwd)?.run_id ?? null;
+	if (!runId) return;
+	try {
+		const current = getRun(ctx.cwd, runId)?.status;
+		if (current !== status && current !== "done" && current !== "abandoned") {
+			setRunStatus(ctx.cwd, runId, status);
+		}
+	} catch {
+		/* best-effort */
+	}
+}
+
+/** Round fingerprint (Q-fingerprint-scope): plan digest + git HEAD +
+ * covered-file mtimes. A change between round start and resolve means the
+ * reviewer judged a subject that no longer exists — discard and re-run. */
+function captureReviewFingerprint(ctx: ExtensionContext, ex: ExecState): string {
+	const parts: string[] = [];
+	try {
+		parts.push(createHash("sha256").update(fs.readFileSync(ex.planPath, "utf8")).digest("hex"));
+	} catch {
+		parts.push("plan-unreadable");
+	}
+	try {
+		parts.push(execSync("git rev-parse HEAD", { cwd: ctx.cwd, stdio: ["ignore", "pipe", "pipe"] }).toString().trim());
+	} catch {
+		parts.push("no-head");
+	}
+	const covered = new Set<string>();
+	for (const task of flattenTaskViews(ex.tasks)) {
+		for (const file of task.files ?? []) covered.add(file);
+	}
+	const mtimes: string[] = [];
+	for (const file of [...covered].sort()) {
+		try {
+			mtimes.push(`${file}:${fs.statSync(path.resolve(ctx.cwd, file)).mtimeMs}`);
+		} catch {
+			mtimes.push(`${file}:missing`);
+		}
+	}
+	parts.push(mtimes.join("|"));
+	return createHash("sha256").update(parts.join("\u0000")).digest("hex");
+}
+
+/** Round timeout: a committed round is minutes, never the 60-min subagent
+ * default — a hung child must surface as a spawn-failure round, not park the
+ * run in verifying for an hour (CF2-010). */
+const REVIEW_ROUND_TIMEOUT_MS = 20 * 60 * 1000;
+
+/** Reviewer-role pinning (Q-role-fallback): a CONFIRMED delegated role pins
+ * the spawn's model+thinking and labels the overlay with the role; an
+ * unconfirmed or current-session role inherits the session default with the
+ * "session default" label — a detached round NEVER opens the interactive
+ * first-use panel. */
+function reviewSpawnProfile(): { model?: string; thinkingLevel?: string; label: string } {
+	try {
+		const reviewer = loadGlobalConfig().config.reviewer;
+		if (reviewer.mode !== "current-session" && reviewerReady(reviewer)) {
+			const spawn = resolveReviewerSpawn(reviewer);
+			if (spawn.modelSelector) {
+				return { model: spawn.modelSelector, thinkingLevel: spawn.thinkingLevel ?? undefined, label: spawn.label };
+			}
+		}
+	} catch {
+		/* fall through to the session default */
+	}
+	return { label: "session default" };
+}
+
+/** Engine-held lane state for the in-flight round: the reopen path builds a
+ * fresh one-shot controller seeded from THIS object, so the accumulated
+ * transcript survives ESC + reopen (CF2-001 / Q-reopen-seed). */
+let reviewLane: RefineLaneState | null = null;
+let reviewOverlay: RefineOverlayController | null = null;
+let reviewModelLabel: string | undefined;
+
+function freshReviewLane(attempt: number): RefineLaneState {
+	return {
+		id: `review-round-${attempt}`,
+		label: `Execution review round ${attempt}`,
+		status: "queued",
+		phase: "queued",
+		detail: "",
+		transcript: [],
+		currentTurnIndex: 0,
+		scrollOffset: 0,
+		followTranscript: true,
+		viewportHeight: 1,
+	};
+}
+
+/** Fresh controller per round (the controller is one-shot: closed latch,
+ * overlayPromise bail, terminal-lane early return — reuse drops progress).
+ * A UI failure must NEVER kill the round itself — best-effort only. */
+function openReviewOverlay(ctx: ExtensionContext, lane: RefineLaneState, lang: "en" | "zh" | undefined, modelLabel: string): RefineOverlayController | null {
+	if (ctx.mode !== "tui" || ctx.hasUI !== true) return null;
+	try {
+		const controller = new RefineOverlayController("auditor", [{ id: lane.id, label: lane.label }], () => {}, lang ?? "en");
+		controller.seedLane(lane);
+		controller.open(refineOverlayContext(ctx), modelLabel);
+		return controller;
+	} catch {
+		return null;
+	}
+}
+
+/** The reopen surface (Task-3.4): rebuilds the overlay from engine-held lane
+ * state; inert when no round is in flight. */
+export function reopenReviewOverlay(ctx: ExtensionContext): void {
+	if (!execution?.review.inFlight || !reviewLane) return;
+	const controller = openReviewOverlay(ctx, reviewLane, execution.uiLanguage, reviewModelLabel ?? "session default");
+	if (controller) reviewOverlay = controller;
+}
+
+function pauseReviewCap(ctx: ExtensionContext, ex: ExecState): void {
+	const detail =
+		ex.audit.failed.length > 0
+			? `failed: ${ex.audit.failed.join(", ")}`
+			: `unreadable verdicts: ${ex.audit.undeterminable.join(", ") || "unknown"}`;
+	const reason = `${REVIEW_CAP_PAUSE_PREFIX} ${REVIEW_MAX_ROUNDS} rounds (${detail}). Only /plans-execute — an explicit user confirmation — grants a fresh five-round budget; ordinary messages and session restores do not. (Or close the failed checks' tasks as skipped to pass them as skipped-pass.)`;
+	pauseForStall(ctx, reason);
+	// In-band, headless-visible pause signal (the pi-plans-exec-stop pattern):
+	// pauseForStall's ui.notify is optional and absent headless, so the pause
+	// must also land in the session stream every mode can read.
+	messaging().sendMessage(
+		{ customType: "pi-plans-review-paused", content: `**pi-plans: ${reason}**`, display: true },
+		{ triggerTurn: false },
+	);
+}
+
+async function startReviewRound(ctx: ExtensionContext): Promise<void> {
+	if (!execution) return;
+	const ex = execution;
+	// Skipped-pass checks resolve without a subagent round.
+	for (const id of presolvedCheckIds(ex.items, ex.tasks)) {
+		const item = ex.items.find((candidate) => candidate.id === id);
+		if (item) item.done = true;
+	}
+	// Only auditable checks (with task coverage) gate completion; checks that
+	// cover no task can never be verified and never block or complete.
+	const pendingChecks = auditableChecks(ex.items, ex.tasks).filter((item) => !item.done);
+	if (pendingChecks.length === 0) {
+		await completeExecution(ctx);
+		return;
+	}
+	if (ex.stall.paused || ex.review.inFlight) return;
+	if (ex.audit.rounds >= REVIEW_MAX_ROUNDS) {
+		pauseReviewCap(ctx, ex);
+		return;
+	}
+	// Phase transition: the executor is done with its tasks; the review loop
+	// owns the run until it converges (or pauses at the cap).
+	setRunStatusForReview(ctx, "verifying");
+	const round: InFlightReview = {
+		controller: new AbortController(),
+		budgetRound: ex.audit.rounds + 1,
+		attempt: ex.review.attempts + 1,
+		fingerprint: captureReviewFingerprint(ctx, ex),
+		wakeSent: false,
+	};
+	ex.review.attempts = round.attempt;
+	ex.review.inFlight = round;
+	ex.audit.running = true; // dashboard mirror (the v0.8 model lands with the overlay task)
+	const spawn = reviewSpawnProfile();
+	reviewModelLabel = spawn.label;
+	const lane = freshReviewLane(round.attempt);
+	reviewLane = lane;
+	reviewOverlay = openReviewOverlay(ctx, lane, ex.uiLanguage, spawn.label);
+	updateStatusWidget(ctx);
+	let result: AuditRoundResult;
+	try {
+		result = auditRunnerForTests
+			? await auditRunnerForTests({ planPath: ex.planPath, checklist: ex.items, tasks: ex.tasks, round: round.attempt })
+			: await runCompletionAudit(ctx, {
+				planPath: ex.planPath,
+				checklist: ex.items,
+				tasks: ex.tasks,
+				round: round.attempt,
+				model: spawn.model,
+				thinkingLevel: spawn.thinkingLevel,
+				timeoutMs: REVIEW_ROUND_TIMEOUT_MS,
+				signal: round.controller.signal,
+				onProgress: (event) => {
+					// The engine owns the lane state; the live controller only repaints.
+					applyRefineProgress(lane, event);
+					reviewOverlay?.rerender();
+				},
+			});
+	} catch (error) {
+		if (ex.review.inFlight === round) {
+			ex.review.inFlight = null;
+			ex.audit.running = false;
+		}
+		void reviewOverlay?.close();
+		reviewOverlay = null;
+		messaging().sendMessage(
+			{ customType: "pi-plans-review-error", content: `pi-plans: execution review round threw: ${String(error)}`, display: true },
+			{ triggerTurn: false },
+		);
+		updateStatusWidget(ctx);
+		return;
+	}
+	// Overlay terminal state + close (the controller is one-shot; the engine-held
+	// lane keeps the transcript for a later reopen within this round).
+	const cancelledResult = result !== null && typeof result === "object" && "cancelled" in result;
+	try {
+		applyRefineResult(lane, {
+			ok: !cancelledResult,
+			output: result && "report" in result ? result.report : "",
+			stderr: "",
+			turns: 0,
+			...(cancelledResult ? { cancelled: true as const } : {}),
+		});
+	} catch {
+		/* cosmetic only */
+	}
+	void reviewOverlay?.close();
+	reviewOverlay = null;
+	await handleReviewOutcome(ctx, ex, round, result, pendingChecks.map((item) => item.id));
+}
+
+async function handleReviewOutcome(
+	ctx: ExtensionContext,
+	owner: ExecState,
+	round: InFlightReview,
+	result: AuditRoundResult,
+	pendingIds: string[],
+): Promise<void> {
+	// Identity guard: a restore, stop, or fresh handoff replaced the run —
+	// drop this outcome silently (CF2-002).
+	if (execution !== owner) return;
+	if (owner.review.inFlight !== round) return;
+	owner.review.inFlight = null;
+	owner.audit.running = false;
+	if (result !== null && typeof result === "object" && "cancelled" in result) {
+		// Aborted by shutdown/stop/restore/tree-switch: no round, no budget, no wake.
+		updateStatusWidget(ctx);
+		return;
+	}
+	const outcome = result;
+	const reportText = outcome?.report ?? "(review subagent failed to run)";
+	const fingerprintNow = captureReviewFingerprint(ctx, owner);
+	const coveredTaskIds = flattenTaskViews(owner.tasks).map((task) => task.id);
+	if (fingerprintNow !== round.fingerprint) {
+		// The audited subject moved under the reviewer (Q-C): discard, re-run
+		// without budget burn; two consecutive discards commit as undeterminable
+		// so a mutating user cannot loop the loop for free (Q-discard-bound).
+		owner.review.consecutiveDiscards += 1;
+		const runDir = runDirOf(ctx);
+		if (runDir) {
+			writeReviewRoundReport(runDir, {
+				budgetRound: round.budgetRound,
+				attempt: round.attempt,
+				outcome: "discarded",
+				passed: [],
+				failed: [],
+				undeterminable: pendingIds,
+				discardedReason: "fingerprint changed between round start and resolve (worktree/plan moved under the reviewer)",
+				fingerprintCaptured: round.fingerprint,
+				fingerprintFound: fingerprintNow,
+				coveredTaskIds,
+				report: reportText,
+			});
+		}
+		if (owner.review.consecutiveDiscards >= 2) {
+			owner.review.consecutiveDiscards = 0;
+			await commitReviewOutcome(
+				ctx,
+				owner,
+				round,
+				{ passed: [], failed: [], undeterminable: pendingIds, report: `(two consecutive fingerprint discards — committed as an undeterminable round)\n\n${reportText}` },
+				pendingIds,
+			);
+			return;
+		}
+		persist(ctx);
+		updateStatusWidget(ctx);
+		await maybeContinueReview(ctx, owner);
+		return;
+	}
+	owner.review.consecutiveDiscards = 0;
+	await commitReviewOutcome(ctx, owner, round, outcome, pendingIds);
+}
+
+async function commitReviewOutcome(
+	ctx: ExtensionContext,
+	ex: ExecState,
+	round: InFlightReview,
+	outcome: { passed: string[]; failed: string[]; undeterminable: string[]; report: string } | null,
+	pendingIds: string[],
+): Promise<void> {
+	// The budget is charged only when an outcome commits — never on discard
+	// or cancellation (CF2-003).
+	ex.audit.rounds = round.budgetRound;
+	const passed = pendingIds.filter((id) => (outcome?.passed ?? []).includes(id));
+	const failed = pendingIds.filter((id) => (outcome?.failed ?? []).includes(id));
+	// Anything the round neither passed nor failed is undeterminable: the
+	// report omitted the check, spelled the verdict unreadably, or the
+	// subagent never ran.
+	const undeterminable = pendingIds.filter((id) => !passed.includes(id) && !failed.includes(id));
+	const coveredTaskIds = flattenTaskViews(ex.tasks).map((task) => task.id);
+	const reportText = outcome?.report ?? "(review subagent failed to run)";
+	{
+		const runDir = runDirOf(ctx);
+		if (runDir) {
+			writeReviewRoundReport(runDir, {
+				budgetRound: round.budgetRound,
+				attempt: round.attempt,
+				outcome: outcome === null
+					? "spawn-failed"
+					: failed.length > 0
+						? "failed"
+						: undeterminable.length > 0 ? "undeterminable" : "passed",
+				passed,
+				failed,
+				undeterminable,
+				fingerprintCaptured: round.fingerprint,
+				coveredTaskIds,
+				report: reportText,
+			});
+		}
+	}
+
+	// Fail-closed completion: every pending check affirmatively passed. An
+	// all-undeterminable round yields failed === [] — completing here would be
+	// fail-open, marking a run done with nothing verified.
+	if (passed.length === pendingIds.length) {
+		ex.audit.failed = [];
+		ex.audit.undeterminable = [];
+		for (const id of passed) {
+			const item = ex.items.find((candidate) => candidate.id === id);
+			if (item) item.done = true;
+		}
+		withExecutionCheckpoint(ctx, (cp) =>
+			applyExecutionProgress(cp, {
+				tasks: taskProgressMap(ex.tasks),
+				doneVcIds: ex.items.filter((item) => item.done).map((item) => item.id),
+				audit: { rounds: ex.audit.rounds, passed: true },
+			}),
+		);
+		await completeExecution(ctx);
+		return;
+	}
+	// Partial progress counts: a check affirmed this round is done even when a
+	// sibling failed, so a later round only re-judges what is still open.
+	for (const id of passed) {
+		const item = ex.items.find((candidate) => candidate.id === id);
+		if (item) item.done = true;
+	}
+	ex.audit.failed = failed;
+	ex.audit.undeterminable = undeterminable;
+	const rolledBack: string[] = [];
+	for (const id of failed) {
+		rolledBack.push(...auditRollbackSet(ex.tasks, ex.items, id));
+	}
+	// A rollback reopens work other checks were verifying; those checks must
+	// stop claiming the run is satisfied there.
+	if (rolledBack.length > 0) invalidateChecksForRolledBackTasks(ex.items, ex.tasks, rolledBack);
+	withExecutionCheckpoint(ctx, (cp) =>
+		applyExecutionProgress(cp, {
+			tasks: taskProgressMap(ex.tasks),
+			doneVcIds: ex.items.filter((item) => item.done).map((item) => item.id),
+			audit: { rounds: ex.audit.rounds, lastResult: failed.join(",") },
+		}),
+	);
+	if (rolledBack.length > 0) {
+		// Rolling back is itself forward progress for the watchdog, but NOT for
+		// audit.rounds: that counter stays monotonic so the repair loop is
+		// bounded. The repair belongs to the executor — back to executing.
+		ex.stall.rounds = 0;
+		ex.stall.lastSnapshot = stallSnapshot();
+		setRunStatusForReview(ctx, "executing");
+	}
+	persist(ctx);
+	updateStatusWidget(ctx);
+	if (failed.length > 0) {
+		// v0.8 wake: per-round one-shot token — exactly one triggerTurn per
+		// committed failed outcome, even when the round resolves long after the
+		// settle that spawned it. The continuation runtime is deliberately
+		// untouched: detached rounds outlive their settle.
+		if (!round.wakeSent) {
+			round.wakeSent = true;
+			const openTasks = flattenTaskViews(ex.tasks)
+				.filter((task) => !taskIsTerminal(task))
+				.map((task) => task.id);
+			const stranded = rolledBack.length === 0;
+			const content = `**pi-plans: execution review round ${ex.audit.rounds} failed** — checks: ${failed.join(", ")}. Rolled back tasks: ${rolledBack.join(", ") || "(none covered)"}. Fix the failures and re-close the rolled-back tasks with \`plans_update_task\`; the review reruns automatically once all tasks are terminal again.${ex.audit.rounds >= REVIEW_MAX_ROUNDS ? ` This was round ${REVIEW_MAX_ROUNDS} of ${REVIEW_MAX_ROUNDS}: the next terminal-task cycle pauses the run for review.` : ""}${stranded ? ` No task covers the failed check(s), so the task tree stayed terminal — the next settle re-runs the review automatically.` : ""}`;
+			messaging().sendMessage(
+				{
+					customType: "pi-plans-audit-failed",
+					content: `${content}\n\nStill open: ${openTasks.join(", ") || "(none — the tree is terminal)"}\n\n---\n${reportText.slice(0, 4000)}`,
+					display: true,
+				},
+				{ triggerTurn: true },
+			);
+		}
+		return; // The agent repairs; the next settle re-enters the loop.
+	}
+	// Undeterminable-only round: the loop self-schedules the retry (Q-B) — no
+	// wake, no message; the dashboard/overlay carries the round counter.
+	await maybeContinueReview(ctx, ex);
+}
+
+async function maybeContinueReview(ctx: ExtensionContext, ex: ExecState): Promise<void> {
+	if (execution !== ex) return;
+	if (!reviewOwed(ex)) return;
+	if (ex.stall.paused) return;
+	if (ex.audit.rounds >= REVIEW_MAX_ROUNDS) {
+		pauseReviewCap(ctx, ex);
+		return;
+	}
+	await startReviewRound(ctx);
+}
+
+/** Launch a review round under the mode rule: detached (fire-and-forget with
+ *  the chain tracked for the test seam) in tui/rpc; awaited inline otherwise
+ *  (print/json settle must hold the runtime open through the round). Returns
+ *  the chain when the caller must await it, null when detached. */
+function launchReviewRound(ctx: ExtensionContext): Promise<void> | null {
+	const detach = ctx.mode === "tui" || ctx.mode === "rpc";
+	const chain = (async () => {
+		await startReviewRound(ctx);
+	})();
+	activeReviewChain = chain;
+	if (detach) {
+		chain.catch(() => {
+			/* surfaced via the review messages */
+		});
+		return null;
+	}
+	return chain;
+}
+
+/** Deterministic seam: await the in-flight (or self-scheduling) review chain. */
+export function __awaitReviewRoundForTests(): Promise<void> {
+	return activeReviewChain ?? Promise.resolve();
+}
+
+/** When this module graph was first imported into the running pi process.
+ * pi loads extensions once, so a fix written to disk mid-session stays
+ * invisible until /reload — which is exactly why an unreadable audit verdict
+ * deserves a /reload hint rather than a bare retry. */
+const extensionModuleLoadedAt = new Date();
+
+/** The /reload advice when the extension on disk is newer than the copy this
+ * process loaded, else null. Shared with /plans via src/staleness.ts so both
+ * report the same answer from one probe. */
+function staleReloadHint(): string | null {
+	try {
+		const root = path.dirname(path.dirname(new URL(import.meta.url).pathname));
+		return probeStaleReload(root, extensionModuleLoadedAt);
+	} catch {
+		return null;
+	}
+}
+
+/** True when the session can surface a pause to a human (D-022): interactive
+ *  TUI/RPC sessions that are not running under PI_PLANS_AUTO_APPROVE. */
+function isInteractiveSession(ctx: ExtensionContext): boolean {
+	if ((ctx.mode !== "tui" && ctx.mode !== "rpc") || ctx.hasUI !== true) return false;
+	return !isAutoApproveEnabledLocal();
+}
+
 const EXECUTION_RESUME_CUSTOM_TYPE = "pi-plans-exec-resume";
 
 function activeVccSettings(ctx: ExtensionContext, phase: PiPlansCompactionPhase): { settings: PiPlansVccSettings; runId: string; artifactDir: string } | null {
@@ -1073,18 +1376,19 @@ function activeVccSettings(ctx: ExtensionContext, phase: PiPlansCompactionPhase)
 	const run = getRun(ctx.cwd, active.run_id);
 	if (!run) return null;
 	if (phase === "planning" && run.status !== "planning") return null;
-	if (phase === "execution" && run.status !== "executing") return null;
+	if (phase === "execution" && run.status !== "executing" && run.status !== "verifying") return null;
 	scaffoldVccSettings(stateRoot);
 	return { settings: loadVccSettings(stateRoot), runId: run.run_id, artifactDir: run.artifact_dir };
 }
 
 function executionVccContext(): PiPlansVccPhaseContext {
+	const current = execution ? currentTask(execution.tasks) : null;
 	return {
 		phase: "execution",
 		planPath: execution?.planPath ?? null,
-		currentI: execution?.currentI ?? null,
+		currentI: current?.id ?? null,
 		remainingVerifierIds: execution?.items.filter((item) => !item.done).map((item) => item.id) ?? [],
-		implementationIds: execution?.implItems?.map((item) => item.id) ?? [],
+		implementationIds: execution ? flattenTaskViews(execution.tasks).map((task) => task.id) : [],
 	};
 }
 
@@ -1128,7 +1432,6 @@ export function buildExecutionCompactionResult(event: SessionBeforeCompactEvent,
 }
 
 export function handleExecutionBeforeCompact(
-	pi: ExtensionAPI,
 	ctx: ExtensionContext,
 	event: SessionBeforeCompactEvent,
 ): SessionBeforeCompactResult | undefined {
@@ -1159,7 +1462,7 @@ export function handleExecutionBeforeCompact(
 	state.pendingStats = built.stats;
 	state.pendingFollowUpPrompt = built.followUpPrompt;
 	state.pendingContinueAfterThresholdCompact = built.settings.continueAfterThresholdCompact;
-	requestExecutionFlush(pi, ctx);
+	requestExecutionFlush();
 	return { compaction: built.compaction };
 }
 
@@ -1167,7 +1470,7 @@ function runtimePiVersion(ctx: ExtensionContext): unknown {
 	return (ctx as ExtensionContext & { piVersion?: unknown }).piVersion ?? VERSION;
 }
 
-export async function handleExecutionCompact(pi: ExtensionAPI, ctx: ExtensionContext, event: SessionCompactEvent): Promise<void> {
+export async function handleExecutionCompact(ctx: ExtensionContext, event: SessionCompactEvent): Promise<void> {
 	if (!execution) return;
 	const state = ensureExecutionCompactionState(ctx);
 	const stats = state.pendingStats;
@@ -1187,10 +1490,10 @@ export async function handleExecutionCompact(pi: ExtensionAPI, ctx: ExtensionCon
 	if (!event.willRetry && stats) {
 		ctx.ui.notify(formatVccCompactionStats(stats), "info");
 		if (followUpPrompt) {
-			await pi.sendUserMessage?.(followUpPrompt);
+			await messaging().sendUserMessage(followUpPrompt);
 		} else if ((event.reason === "threshold" || event.reason === "overflow") && shouldScheduleAutoContinue(continueAfterThresholdCompact, runtimePiVersion(ctx))) {
 			state.resumeGuard = true;
-			pi.sendMessage(
+			messaging().sendMessage(
 				{
 					customType: EXECUTION_RESUME_CUSTOM_TYPE,
 					content: EXECUTION_COMPACTION_RESUME_MESSAGE,
@@ -1200,18 +1503,15 @@ export async function handleExecutionCompact(pi: ExtensionAPI, ctx: ExtensionCon
 			);
 		}
 	}
-	requestExecutionFlush(pi, ctx);
+	requestExecutionFlush();
 	updateStatusWidget(ctx);
 }
 
-
-export function handleExecutionCompactFailed(pi: ExtensionAPI, ctx: ExtensionContext, event: SessionCompactFailedEvent): void {
+export function handleExecutionCompactFailed(ctx: ExtensionContext, event: SessionCompactFailedEvent): void {
 	if (!execution) return;
 	const state = executionCompactionState(ctx);
 	const terminal = isTerminalCompactionFailure(event);
 	if (terminal) {
-		// Pi refused or aborted the compaction. Hold the cooldown and re-arm
-		// only after real growth or high-watermark pressure so the loop stops.
 		if (state) {
 			state.inFlight = false;
 			state.resumeGuard = false;
@@ -1228,7 +1528,7 @@ export function handleExecutionCompactFailed(pi: ExtensionAPI, ctx: ExtensionCon
 			? "pi-plans: compaction found nothing to summarize; backing off until the session grows past the keep-recent window."
 			: "pi-plans: compaction was aborted (provider interruption, user cancel, or a competing manual compact); backing off until the session grows or usage nears the window.";
 		ctx.ui.notify(message, "info");
-		requestExecutionFlush(pi, ctx);
+		requestExecutionFlush();
 		return;
 	}
 	if (state) {
@@ -1245,7 +1545,7 @@ export function handleExecutionCompactFailed(pi: ExtensionAPI, ctx: ExtensionCon
 		`pi-plans: compaction failed (${event.reason}); execution remains active and will wait for the next eligible turn.`,
 		"warning",
 	);
-	requestExecutionFlush(pi, ctx);
+	requestExecutionFlush();
 }
 
 export function filterExecutionResumeMessages<T extends { customType?: string }>(messages: T[]): T[] {
@@ -1255,24 +1555,12 @@ export function filterExecutionResumeMessages<T extends { customType?: string }>
 // ---------------------------------------------------------------------------
 // Planning-phase compaction: Pi core owns scheduling; this hook customizes
 // active planning compact events with the same VCC builder used by execution.
-// The two state machines are kept independent (different memory slot and
-// snapshot key) so execution never bleeds into planning.
 // ---------------------------------------------------------------------------
 
 export const PLANNING_RUN_START_CUSTOM_TYPE = "pi-plans-run-start";
 export const PLANNING_PLAN_WRITTEN_CUSTOM_TYPE = "pi-plans-plan-written";
 const PLANNING_RESUME_CUSTOM_TYPE = "pi-plans-plan-resume";
 
-// ---------------------------------------------------------------------------
-// Pre-plan compaction: right after `plans start-run` creates a new planning
-// run, the extension triggers one VCC compaction so the new plan starts on a
-// lean context (LLM reasoning degrades with longer context; see PLAN
-// preplan-compact). The pending flag is session-scoped and opportunistic: it
-// is set by the start-run tool case and consumed by the plans tool_result
-// hook in index.ts, which requests the extension-context compact action and
-// resumes planning exactly once regardless of success or failure.
-// ---------------------------------------------------------------------------
-
 export { PLANNING_PREPLAN_COMPACT_HINT };
 export const PLANNING_PREPLAN_RESUME_CUSTOM_TYPE = "pi-plans-preplan-resume";
 
@@ -1292,11 +1580,8 @@ export function consumePrePlanCompactPending(ctx: ExtensionContext): PrePlanComp
 	return pending;
 }
 
-/** Hidden resume message after the pre-plan compaction settles (success or
- *  failure): Pi's manual compaction never continues the aborted turn, so the
- *  planning workflow is continued exactly once from here. */
-export function sendPrePlanCompactResume(pi: ExtensionAPI): void {
-	pi.sendMessage?.(
+export function sendPrePlanCompactResume(ctx: ExtensionContext): void {
+	messaging().sendMessage(
 		{
 			customType: PLANNING_PREPLAN_RESUME_CUSTOM_TYPE,
 			content: "Continue planning.",
@@ -1313,7 +1598,6 @@ interface PlanningCompactionState {
 	lastAttemptReason: "manual" | "threshold" | "overflow" | null;
 	lastSuccessfulUsagePercent: number | null;
 	lastSuccessfulAt: string | null;
-	/** Terminal "nothing to compact" backoff: tokens observed when Pi refused. */
 	terminalBackoffTokens: number | null;
 	pendingStats: VccCompactionStats | null;
 	pendingFollowUpPrompt: string | null;
@@ -1341,8 +1625,6 @@ function isTerminalCompactionFailure(event: { errorMessage?: string; aborted?: b
 	if (message.includes("nothing to compact") || message.includes("already compacted") || message.includes("session too small")) {
 		return { kind: "content" };
 	}
-	// abort/stream class: explicit event names only, so that provider blips
-	// (network down, etc.) stay retryable.
 	const abortPatterns = [
 		"this operation was aborted",
 		"aborted",
@@ -1354,20 +1636,12 @@ function isTerminalCompactionFailure(event: { errorMessage?: string; aborted?: b
 	if (abortPatterns.some((pattern) => message.includes(pattern))) {
 		return { kind: "abort-stream" };
 	}
-	// Aborted with no recognized message: still an abort-class terminal so the
-	// next eligible turn does not immediately retry the same operation.
 	if (event.aborted === true) {
 		return { kind: "abort-stream" };
 	}
 	return null;
 }
 
-/** Session-scoped phase-local "compaction in flight" guard.
- *  - Set on `session_before_compact` for the phase attributed by the custom
- *    instructions hint; auto-compaction (no hint) marks both phases defensively.
- *  - Cleared on `session_compact` and `session_compact_failed`.
- *  - Retained so lifecycle events expose the same phase-local state to tests
- *    and future Pi core schema additions. */
 type CompactionPhase = "planning" | "execution";
 
 function compactionLifecycleStore(ctx: ExtensionContext): {
@@ -1396,18 +1670,11 @@ export function noteCompactionStarted(ctx: ExtensionContext, customInstructions:
 	} else if (isExecutionCustomInstructions(customInstructions)) {
 		store.execution = true;
 	} else {
-		// Auto-compaction (threshold/overflow/manual without our hint) marks both.
 		store.planning = true;
 		store.execution = true;
 	}
 }
 
-/** Pi core's `SessionCompactEvent` / `SessionCompactFailedEvent` do not carry
- *  `customInstructions` in any emission site, so the END side has no way to
- *  know which phase the compaction belonged to. Clearing both phases is the
- *  safe default — the per-phase start side (above) already encodes the hint
- *  attribution. The hint parameter is retained for API symmetry and future
- *  Pi core schema additions. */
 export function noteCompactionEnded(ctx: ExtensionContext, _customInstructions: unknown): void {
 	const store = compactionLifecycleStore(ctx);
 	store.planning = false;
@@ -1431,15 +1698,11 @@ export function consumePlanningCompactionResumeGuard(ctx: ExtensionContext): boo
 }
 
 export function refreshPlanningCompactionCooldown(_ctx: ExtensionContext): void {
-	// Pi core owns scheduling; retained for lifecycle compatibility only.
+	// Retained for lifecycle compatibility only.
 }
 
 export function requestPlanningCompaction(_ctx: ExtensionContext): void {
-	// Generic proactive pi-plans compaction is intentionally disabled. Manual,
-	// threshold, and overflow compactions are handled by session_before_compact.
-	// The single exception is the pre-plan compaction: index.ts requests the
-	// extension-context compact action from the plans tool_result hook right
-	// after start-run (see PLANNING_PREPLAN_COMPACT_HINT).
+	// Manual, threshold, and overflow compactions are handled by session_before_compact.
 }
 
 function buildPlanningVccResult(event: SessionBeforeCompactEvent, ctx: ExtensionContext): VccCompactionBuildResult | null {
@@ -1464,7 +1727,6 @@ export function buildPlanningCompactionResult(event: SessionBeforeCompactEvent,
 }
 
 export function handlePlanningBeforeCompact(
-	pi: ExtensionAPI,
 	ctx: ExtensionContext,
 	event: SessionBeforeCompactEvent,
 ): SessionBeforeCompactResult | undefined {
@@ -1498,7 +1760,7 @@ export function handlePlanningBeforeCompact(
 	return { compaction: built.compaction };
 }
 
-export async function handlePlanningCompact(pi: ExtensionAPI, ctx: ExtensionContext, event: SessionCompactEvent): Promise<void> {
+export async function handlePlanningCompact(ctx: ExtensionContext, event: SessionCompactEvent): Promise<void> {
 	if (getExecution()) return;
 	const session = ctx.sessionManager as unknown as { __planningCompaction?: PlanningCompactionState };
 	const state = session.__planningCompaction;
@@ -1519,10 +1781,10 @@ export async function handlePlanningCompact(pi: ExtensionAPI, ctx: ExtensionCont
 	if (!event.willRetry && stats) {
 		ctx.ui.notify(formatVccCompactionStats(stats), "info");
 		if (followUpPrompt) {
-			await pi.sendUserMessage?.(followUpPrompt);
+			await messaging().sendUserMessage(followUpPrompt);
 		} else if ((event.reason === "threshold" || event.reason === "overflow") && shouldScheduleAutoContinue(continueAfterThresholdCompact, runtimePiVersion(ctx))) {
 			state.resumeGuard = true;
-			pi.sendMessage(
+			messaging().sendMessage(
 				{
 					customType: PLANNING_RESUME_CUSTOM_TYPE,
 					content: "Continue planning.",
@@ -1534,16 +1796,13 @@ export async function handlePlanningCompact(pi: ExtensionAPI, ctx: ExtensionCont
 	}
 }
 
-
-export function handlePlanningCompactFailed(pi: ExtensionAPI, ctx: ExtensionContext, event: SessionCompactFailedEvent): void {
+export function handlePlanningCompactFailed(ctx: ExtensionContext, event: SessionCompactFailedEvent): void {
 	if (getExecution()) return;
 	const session = ctx.sessionManager as unknown as { __planningCompaction?: PlanningCompactionState };
 	const state = session.__planningCompaction;
 	if (!state) return;
 	const terminal = isTerminalCompactionFailure(event);
 	if (terminal) {
-		// Pi refused or aborted the compaction. Hold the cooldown and re-arm
-		// only after real growth or high-watermark pressure so the loop stops.
 		state.inFlight = false;
 		state.resumeGuard = false;
 		state.cooldownActive = true;
@@ -1576,19 +1835,20 @@ export function filterPlanningResumeMessages<T extends { customType?: string }>(
 	return messages.filter((message) => message.customType !== PLANNING_RESUME_CUSTOM_TYPE && message.customType !== PLANNING_PREPLAN_RESUME_CUSTOM_TYPE);
 }
 
-export async function stopExecution(pi: ExtensionAPI, ctx: ExtensionContext, reason: string): Promise<void> {
+export async function stopExecution(ctx: ExtensionContext, reason: string): Promise<void> {
 	if (!execution) return;
+	// A stopped run's in-flight review round dies with it (typed cancelled —
+	// no budget, no wake).
+	abortInFlightReview();
 	resetExecutionCompactionState(ctx);
-	// Final synchronous write: drain any deferred flush and land the last snapshot.
 	pendingExecutionFlush = false;
-	persist(pi);
-	// Checkpoint first: withExecutionCheckpoint guards on the live execution.
+	persist(ctx);
 	withExecutionCheckpoint(ctx, (cp) => applyExecutionStopped(cp, reason));
 	execution = null;
 	executionRunId = null;
-	goalWaitRuntime = null;
-	pi.appendEntry("pi-plans-exec-cleared", { reason });
-	pi.sendMessage(
+	continuationRuntime = null;
+	messaging().appendEntry("pi-plans-exec-cleared", { reason });
+	messaging().sendMessage(
 		{
 			customType: "pi-plans-exec-stop",
 			content: `**pi-plans: execution stopped** — ${reason}`,
@@ -1607,84 +1867,76 @@ export async function stopExecution(pi: ExtensionAPI, ctx: ExtensionContext, rea
 	updateStatusWidget(ctx);
 }
 
-/** Apply [DONE:VC-xxx] markers from an assistant message. Returns changed ids. */
-export function applyDoneMarkers(text: string): string[] {
-	if (!execution) return [];
-	const changed: string[] = [];
-	for (const id of scanDoneMarkers(text)) {
-		const item = execution.items.find((candidate) => candidate.id === id && !candidate.done);
-		if (item) {
-			item.done = true;
-			changed.push(id);
-		}
-	}
-	return changed;
+/** v0.7.1: the per-settle latch, created on demand so no execution-construction
+ * path can leave it undefined (a missing latch must degrade to "no latch",
+ * never throw inside a lifecycle handler). */
+function auditLatchOf(ex: ExecState): ExecState["auditLatch"] {
+	if (!ex.auditLatch) ex.auditLatch = { auditedThisSettle: false, activity: 0 };
+	return ex.auditLatch;
+}
+
+function stallSnapshot(): string {
+	if (!execution) return "";
+	// v0.7.1: the snapshot carries the round's tool-activity counter, so a round
+	// in which the agent legitimately did work (read code, run commands) counts
+	// as progress even when no task changed status. Only a round with neither a
+	// status change NOR a successful tool result is "no progress".
+	return JSON.stringify({ tasks: taskProgressMap(execution.tasks), activity: auditLatchOf(execution).activity });
 }
 
 /**
- * Apply [I-xxx:implemented|validating] markers from an assistant message.
- * Unknown I-ids are silently ignored; later markers overwrite earlier ones.
- * Returns the ids whose state actually changed.
+ * v0.7.1: shared "the execution review is owed" predicate. Every entry point
+ * that can start the audit (turn_end, agent_before_settle, restoreFromSession,
+ * the resume path) goes through this so they can never disagree.
+ *
+ * Semantics (unchanged from restoreFromSession's guard, F-006): a check that
+ * covers no task never gates completion, so only auditable checks count.
  */
-export function applyImplMarkers(text: string): string[] {
-	if (!execution?.implItems?.length) return [];
-	const known = new Set(execution.implItems.map((impl) => impl.id));
-	execution.implStatus ??= {};
-	const changed: string[] = [];
-	for (const marker of scanImplMarkers(text)) {
-		if (!known.has(marker.id)) continue;
-		const previous = execution.implStatus[marker.id];
-		execution.implStatus[marker.id] = marker.state;
-		if (previous !== marker.state) changed.push(marker.id);
-	}
-	return changed;
-}
-
-export function applyCurrentIMarker(text: string): boolean {
-	if (!execution?.implItems?.length) return false;
-	const markers = scanCurrentIMarkers(text);
-	const resolved = resolveCurrentI(execution.implItems, markers, execution.currentI);
-	if (!resolved || resolved === execution.currentI) return false;
-	execution.currentI = resolved;
-	return true;
+function pendingAudit(ex: ExecState | null = execution): ex is ExecState {
+	if (!ex) return false;
+	// A paused run is never self-driven: the stall / review-cap pause is an
+	// explicit "hand control back" signal, and resuming it is the user's call.
+	// This also bounds the zero-input continue loop in agent_before_settle.
+	if (ex.stall.paused) return false;
+	if (ex.review.inFlight) return false;
+	return allTasksTerminal(ex.tasks) && auditableChecks(ex.items, ex.tasks).some((item) => !item.done);
 }
 
-export function isExecutionComplete(): boolean {
-	return execution !== null && execution.items.length > 0 && execution.items.every((item) => item.done);
+/** v0.7.1: record that this settle already ran (or declined) its audit, so a
+ * second entry point in the same settle cannot re-consume a round. */
+function latchAuditThisSettle(): void {
+	if (execution) auditLatchOf(execution).auditedThisSettle = true;
 }
 
-function goalWaitSnapshot(): string {
-	if (!execution) return "";
-	return JSON.stringify({
-		done: execution.items
-			.filter((item) => item.done)
-			.map((item) => item.id)
-			.sort()
-			.join("|"),
-		implStatus: execution.implStatus ?? {},
-		currentI: execution.currentI ?? null,
-	});
+/** v0.7.1: called on agent_start — a new agent run is a new settle window, so
+ * the latch and the activity counter both reset here. */
+function resetSettleLatch(): void {
+	if (!execution) return;
+	const latch = auditLatchOf(execution);
+	latch.auditedThisSettle = false;
+	latch.activity = 0;
 }
 
-function pauseGoalWait(pi: ExtensionAPI, ctx: ExtensionContext, reason: string): void {
+function pauseForStall(ctx: ExtensionContext, reason: string): void {
 	const ex = getExecution();
-	if (!ex?.goalWait) return;
-	ex.goalWait.paused = true;
-	ex.goalWait.pausedReason = reason;
-	persist(pi);
+	if (!ex) return;
+	ex.stall.paused = true;
+	ex.stall.pausedReason = reason;
+	withExecutionCheckpoint(ctx, (cp) => applyExecutionProgress(cp, { pausedReason: reason }));
+	persist(ctx);
 	ctx.ui.notify?.(
-		`pi-plans: goal-wait paused (${reason}). Send any message or run /plans-execute to resume.`,
+		`pi-plans: execution paused (${reason}). Send any message or run /plans-execute to resume.`,
 		"warning",
 	);
 	updateStatusWidget(ctx);
 }
 
-function canWakeExecution(ctx: ExtensionContext, runtime: GoalWaitRuntime): boolean {
+function canWakeExecution(ctx: ExtensionContext, runtime: ContinuationRuntime): boolean {
 	const compaction = executionCompactionState(ctx);
-	return currentGoalWaitRuntime(ctx) === runtime
+	return currentContinuationRuntime(ctx) === runtime
 		&& (ctx.mode === "tui" || ctx.mode === "rpc")
-		&& !isExecutionComplete()
-		&& !runtime.owner.goalWait?.paused
+		&& !allTasksTerminal(runtime.owner.tasks)
+		&& !runtime.owner.stall.paused
 		&& ctx.isIdle()
 		&& !ctx.hasPendingMessages()
 		&& !ctx.signal?.aborted
@@ -1694,15 +1946,14 @@ function canWakeExecution(ctx: ExtensionContext, runtime: GoalWaitRuntime): bool
 		&& compaction?.pendingFollowUpPrompt == null;
 }
 
-function sendGoalWaitWake(pi: ExtensionAPI, ctx: ExtensionContext, runtime: GoalWaitRuntime): boolean {
+function sendContinuationWake(ctx: ExtensionContext, runtime: ContinuationRuntime): boolean {
 	if (!canWakeExecution(ctx, runtime)) return false;
 	try {
-		// Custom messages bypass before_agent_start, so carry fresh execution rules.
 		const content = executionContextMessage(ctx);
 		if (!content) return false;
 		runtime.wakeId = randomUUID();
-		pi.sendMessage({
-			customType: GOAL_WAIT_CUSTOM_TYPE,
+		messaging().sendMessage({
+			customType: EXECUTION_CONTINUE_CUSTOM_TYPE,
 			content,
 			display: false,
 			details: { wakeId: runtime.wakeId },
@@ -1710,120 +1961,161 @@ function sendGoalWaitWake(pi: ExtensionAPI, ctx: ExtensionContext, runtime: Goal
 		return true;
 	} catch (error) {
 		runtime.wakeId = undefined;
-		pauseGoalWait(pi, ctx, `continuation failed: ${String(error)}`);
+		pauseForStall(ctx, `continuation failed: ${String(error)}`);
 		return false;
 	}
 }
 
 /** Only a fully settled agent run can need an extra wake, never a tool turn. */
-function maybeGoalWaitFollowUp(pi: ExtensionAPI, ctx: ExtensionContext): void {
-	const runtime = currentGoalWaitRuntime(ctx);
+function maybeContinuationFollowUp(ctx: ExtensionContext): void {
+	const runtime = currentContinuationRuntime(ctx);
 	if (!runtime || runtime.handled || !ctx.isIdle()) return;
 	if (ctx.mode !== "tui" && ctx.mode !== "rpc") return;
 	if (runtime.stopReason === "error" || runtime.stopReason === "aborted" || ctx.signal?.aborted) {
 		runtime.handled = true;
-		pauseGoalWait(pi, ctx, runtime.stopReason === "error" ? "agent failed" : "agent interrupted");
+		pauseForStall(ctx, runtime.stopReason === "error" ? "agent failed" : "agent interrupted");
 		return;
 	}
+	// v0.7.1: a fully-terminal run that still owes an audit is NOT a
+	// continuation case — the audit owns that state (agent_before_settle).
+	// Return without waking: emitting EXECUTION_CONTINUE here would send the
+	// agent back to redo work it has already finished (F-003).
+	if (execution && allTasksTerminal(execution.tasks) && pendingAudit(execution)) return;
 	if (runtime.stopReason !== "stop" || !canWakeExecution(ctx, runtime)) return;
 	runtime.handled = true;
 	const ex = runtime.owner;
-	ex.goalWait ??= { noProgressRounds: 0, waitRounds: 0, lastMarkers: null, paused: false };
-	const goalWait = ex.goalWait;
-	const snapshot = goalWaitSnapshot();
-	const changed = goalWait.lastMarkers !== null && snapshot !== goalWait.lastMarkers;
-	goalWait.lastMarkers = snapshot;
+	const snapshot = stallSnapshot();
+	const changed = ex.stall.lastSnapshot !== null && snapshot !== ex.stall.lastSnapshot;
+	ex.stall.lastSnapshot = snapshot;
 	if (changed) {
-		goalWait.noProgressRounds = 0;
-		goalWait.waitRounds = 0;
-	} else if (/waiting for/i.test(runtime.text)) {
-		goalWait.waitRounds += 1;
+		ex.stall.rounds = 0;
 	} else {
-		goalWait.noProgressRounds += 1;
-	}
-	if (goalWait.noProgressRounds >= GOAL_WAIT_MAX_NO_PROGRESS) {
-		pauseGoalWait(pi, ctx, `no progress in ${goalWait.noProgressRounds} rounds`);
-		return;
+		ex.stall.rounds += 1;
 	}
-	if (goalWait.waitRounds >= GOAL_WAIT_MAX_WAITING) {
-		pauseGoalWait(pi, ctx, `waiting without progress for ${goalWait.waitRounds} rounds`);
+	if (ex.stall.rounds >= STALL_MAX_ROUNDS) {
+		pauseForStall(ctx, `no task-status change in ${ex.stall.rounds} rounds`);
 		return;
 	}
-	persist(pi);
+	persist(ctx);
 	updateStatusWidget(ctx);
-	// No await between the live gate and dispatch: another input cannot interleave.
-	sendGoalWaitWake(pi, ctx, runtime);
+	sendContinuationWake(ctx, runtime);
 }
 
 export function filterGoalWaitMessages<T extends { customType?: string; details?: unknown }>(messages: T[]): T[] {
-	return messages.filter((message) => message.customType !== GOAL_WAIT_CUSTOM_TYPE
-		|| (goalWaitRuntime?.owner === execution && goalWaitRuntime?.wakeId !== undefined
-			&& (message.details as { wakeId?: unknown } | undefined)?.wakeId === goalWaitRuntime.wakeId));
+	// v0.6.1: continuation wakes are one-shot; stale ones (including the
+	// legacy v0.6.0 goal-wait type) never replay after a restart.
+	return messages.filter((message) => message.customType !== EXECUTION_CONTINUE_CUSTOM_TYPE
+		&& message.customType !== LEGACY_GOAL_WAIT_CUSTOM_TYPE);
+}
+
+export function filterContinuationMessages<T extends { customType?: string; details?: unknown }>(messages: T[]): T[] {
+	return filterGoalWaitMessages(messages);
 }
 
-/** Called only for genuine user input or an explicit same-execution resume. */
-export function resumeGoalWaitIfPaused(pi: ExtensionAPI, ctx: ExtensionContext): boolean {
+/** Called for genuine user input or an explicit same-execution resume.
+ * v0.8: a REVIEW-CAP pause is never lifted here — ordinary input must not
+ * refill the five-round budget (CF2-004); only /plans-execute
+ * (resumeActiveExecution) is the explicit confirmation surface. Genuine
+ * stall pauses still clear on input as before. */
+export function resumeGoalWaitIfPaused(ctx: ExtensionContext): boolean {
 	const ex = getExecution();
-	if (!ex?.goalWait?.paused || !currentGoalWaitRuntime(ctx)) return false;
-	ex.goalWait.paused = false;
-	ex.goalWait.pausedReason = undefined;
-	ex.goalWait.noProgressRounds = 0;
-	ex.goalWait.waitRounds = 0;
-	ex.goalWait.lastMarkers = goalWaitSnapshot();
-	persist(pi);
+	if (!ex?.stall.paused || !currentContinuationRuntime(ctx)) return false;
+	if (isReviewCapPause(ex.stall.pausedReason)) {
+		// Surfaced once per input so the user is not left guessing why the run
+		// stays paused; the pause itself and the budget survive untouched.
+		ctx.ui.notify?.(
+			"pi-plans: the review-round budget is exhausted — run /plans-execute to grant a fresh five-round budget (that confirmation is the only surface that does).",
+			"warning",
+		);
+		return false;
+	}
+	ex.stall.paused = false;
+	ex.stall.pausedReason = undefined;
+	ex.stall.rounds = 0;
+	ex.stall.lastSnapshot = stallSnapshot();
+	withExecutionCheckpoint(ctx, (cp) => applyExecutionProgress(cp, { pausedReason: null }));
+	persist(ctx);
 	updateStatusWidget(ctx);
 	return true;
 }
 
-export function resumeActiveExecution(pi: ExtensionAPI, ctx: ExtensionContext): boolean {
-	if (!resumeGoalWaitIfPaused(pi, ctx)) return false;
-	const runtime = currentGoalWaitRuntime(ctx)!;
+export function resumeActiveExecution(ctx: ExtensionContext): boolean {
+	// v0.8: /plans-execute is THE explicit confirmation surface for a
+	// review-cap pause — the only place a fresh five-round budget is granted
+	// (Q-confirm-surface). Ordinary input and session restores never refill.
+	const pausedEx = getExecution();
+	if (pausedEx?.stall.paused && isReviewCapPause(pausedEx.stall.pausedReason)) {
+		pausedEx.stall.paused = false;
+		pausedEx.stall.pausedReason = undefined;
+		pausedEx.stall.rounds = 0;
+		pausedEx.stall.lastSnapshot = stallSnapshot();
+		pausedEx.audit.rounds = 0;
+		pausedEx.audit.failed = [];
+		pausedEx.audit.undeterminable = [];
+		withExecutionCheckpoint(ctx, (cp) =>
+			applyExecutionProgress(cp, {
+				tasks: taskProgressMap(pausedEx.tasks),
+				audit: { rounds: 0, lastResult: undefined },
+				pausedReason: null,
+			}),
+		);
+		persist(ctx);
+		updateStatusWidget(ctx);
+		messaging().sendMessage(
+			{
+				customType: "pi-plans-review-budget-granted",
+				content: "**pi-plans: fresh five-round review budget granted** — the execution review resumes now.",
+				display: true,
+			},
+			{ triggerTurn: false },
+		);
+		const grantChain = launchReviewRound(ctx);
+		if (grantChain) void grantChain.catch(() => { /* surfaced via the review messages */ });
+		return true;
+	}
+	// v0.7.1 (root cause A): a terminal-but-unaudited run used to fall through
+	// to `return false` here, so `/plans-execute` answered "already executing"
+	// and the run stayed stranded until a full re-entry or a session restore.
+	// It is not paused, so the pause path below cannot see it — check it first
+	// and run the owed review instead of reporting "nothing to resume".
+	if (!execution?.stall.paused && pendingAudit()) {
+		latchAuditThisSettle();
+		const chain = launchReviewRound(ctx);
+		if (chain) void chain.catch(() => { /* surfaced via the review messages */ });
+		return true;
+	}
+	if (!resumeGoalWaitIfPaused(ctx)) return false;
+	const runtime = currentContinuationRuntime(ctx)!;
 	if (canWakeExecution(ctx, runtime)) {
 		runtime.handled = true;
-		sendGoalWaitWake(pi, ctx, runtime);
+		sendContinuationWake(ctx, runtime);
 	}
 	return true;
 }
 
-export async function completeExecution(pi: ExtensionAPI, ctx: ExtensionContext): Promise<void> {
+export async function completeExecution(ctx: ExtensionContext): Promise<void> {
 	if (!execution) return;
 	resetExecutionCompactionState(ctx);
-	// Final synchronous write: drain any deferred flush and land the last snapshot.
 	pendingExecutionFlush = false;
-	persist(pi);
-
-	const summary = execution.items.map((item) => `- ✅ \`${item.id}\` ${item.text.split(";")[0]}`).join("\n");
+	persist(ctx);
+	const flat = flattenTaskViews(execution.tasks);
+	const summary = flat
+		.map((task) => `- ${taskIsTerminal(task) && task.status === "skipped" ? "~" : "✓"} \`${task.id}\` ${task.title}`)
+		.join("\n");
 	const planPath = execution.planPath;
-	// Checkpoint first (live-execution guard), then clear the session state.
 	withExecutionCheckpoint(ctx, (cp) => applyExecutionCompleted(cp));
 	execution = null;
 	executionRunId = null;
-	goalWaitRuntime = null;
-	pi.appendEntry("pi-plans-exec-cleared", { reason: "complete" });
-	// Post-execution goal-running continuation: in interactive sessions, attach
-	// the continuation block and trigger a new turn so the agent immediately
-	// enters the implementation-review loop. Headless sessions keep the silent
-	// completion behavior. Both completeExecution call sites (turn_end and the
-	// restoreFromSession recovery path) share this behavior.
-	const interactive = ctx.hasUI === true;
-	// Skill-aware continuation: the reviewer-count default follows the active
-	// run's skill (D-1/D-4), so the prompt names the run's own recommended
-	// count instead of a static guess.
-	const activeRunForPrompt = resolveActiveRun(ctx.sessionManager, ctx.cwd);
-	const content = interactive
-		? `**Plan complete!** ✅ \`${planPath}\`\n\n${summary}\n\n${ameliorationPromptText(activeRunForPrompt?.skill)}`
-		: `**Plan complete!** ✅ \`${planPath}\`\n\n${summary}`;
-	pi.sendMessage(
+	continuationRuntime = null;
+	messaging().appendEntry("pi-plans-exec-cleared", { reason: "complete" });
+	messaging().sendMessage(
 		{
 			customType: "pi-plans-complete",
-			content,
+			content: `**Plan complete!** ✅ \`${planPath}\` — execution review passed.\n\n${summary}`,
 			display: true,
 		},
-		{ triggerTurn: interactive },
+		{ triggerTurn: false },
 	);
-	if (interactive) {
-		pi.appendEntry("pi-plans-ameliorate", { planPath, phase: "goal-started", rounds: null, currentRound: 0 });
-	}
 	const active = resolveActiveRun(ctx.sessionManager, ctx.cwd);
 	if (active) {
 		try {
@@ -1835,55 +2127,45 @@ export async function completeExecution(pi: ExtensionAPI, ctx: ExtensionContext)
 	updateStatusWidget(ctx);
 }
 
-/** Instructions appended to the post-execution completion message in
- * interactive sessions, telling the agent to enter the goal-running
- * implementation-review loop. Skill-aware: the reviewer-count question's
- * recommended option follows the run's skill (plan-big / plan-with-refs → 3,
- * others → 1). Termination options are single-sourced from
- * src/termination-prompt.ts (shared with the ask_choice trailing branch). */
-export function ameliorationPromptText(skill: string | undefined): string {
-	return `---
-Goal-running continuation: immediately ask the user now via ask_choice (autoComplete: false, in the session language) the termination question: "${TERMINATION_QUESTION}" Options (recommended first): ${renderTerminationOptions()}. ${TERMINATION_RECORDING_INSTRUCTIONS} ${implReviewerCountPromptLine(skill)} Then keep running the implementation-review loop without asking whether to continue; the goal-wait option keeps the loop running until no unpassed VCs remain.`;
-}
-
 /** Injection text for before_agent_start while executing. */
 export function executionContextMessage(ctx: ExtensionContext): string | null {
 	if (!execution) return null;
-	const remaining = execution.items.filter((item) => !item.done);
-	const list =
-		remaining.map((item) => `- \`${item.id}\` ${item.text}`).join("\n") || "(none — report completion now)";
-	// Live read: the injected guidance and the tool wrappers share the same
-	// tri-state, so they can never contradict each other mid-run.
+	const flat = flattenTaskViews(execution.tasks);
+	const open = flat.filter((task) => !taskIsTerminal(task));
+	const cur = currentTask(execution.tasks);
+	const currentWave = cur?.wave ?? 1;
+	const inWave = open.filter((task) => task.wave === currentWave);
+	const waveList = inWave.map((task) => `- ${task.id}${task.children.length ? ` (${task.children.map((c) => c.id).join(", ")})` : ""}: ${task.title}${task.files.length ? ` — files: ${task.files.join(", ")}` : ""}`).join("\n") || "(none — take the next wave)";
+	const progress = taskProgress(execution.tasks);
+	const vcDone = execution.items.filter((item) => item.done).length;
 	const mode = resolveGraphMode(ctx?.cwd ?? process.cwd());
 	const graphLine =
 		mode === "config-unavailable"
-			? `${graphBlockForExecutor(false)}\n[pi-plans: config unreadable this turn; graph features are off until .git/pi_plans/config.json is repaired]`
+			? `${graphBlockForExecutor(false)}\n[pi-plans: config unreadable this turn; graph features are off until .git/pi-plans/config.json is repaired]`
 			: graphBlockForExecutor(mode === "enabled");
-	// F-002 (impl review r1): the next-action line is hoisted out of the
-	// implItems ternary so plans without implementation items get the same
-	// same-source guidance the panel shows.
-	const nextActionLine = `\nSuggested next action (displayed in the pi-plans panel): ${deriveNextAction(execution, executionIsWaiting(execution), resolveImplStatuses(execution.implItems ?? [], execution.items, execution.implStatus), remaining, execution.currentI)}`;
-	const implementationItems = execution.implItems?.length
-		? `\nImplementation items: ${execution.implItems.map((item) => item.id).join(", ")}${execution.currentI ? `\nCurrent implementation item: \`${execution.currentI}\`` : ""}\nWhen beginning an implementation item, emit its current anchor exactly once as \`[I-###:current]\`; then use \`[I-###:implemented]\` or \`[I-###:validating]\` for progress.`
+	const rollbackNote = execution.audit.failed.length > 0
+		? `\nExecution review round ${execution.audit.rounds} failed checks: ${execution.audit.failed.join(", ")} — the covered tasks were rolled back to pending; re-close them with evidence after fixing the failures.`
 		: "";
 	return `[PI-PLANS EXECUTION — write access enabled]
-Implement the accepted plan at ${execution.planPath} (${execution.items.length - remaining.length}/${execution.items.length} verifier items done).
+Implement the accepted plan at ${execution.planPath} (tasks ${progress.done}/${progress.total}${execution.legacyPlan ? " · legacy I-### mapping" : ""} · VC ${vcDone}/${execution.items.length}).
+
+Current wave ${currentWave} open tasks:
+${waveList}
 
-Remaining verifier items:
-${list}${implementationItems}${nextActionLine}
+Remaining open tasks (all waves): ${open.map((task) => task.id).join(", ") || "(none)"}.${rollbackNote}
 
 ${graphLine}
 
 Execution rules:
-- Implement implementation items in dependency order; grow the change in layers — smallest end-to-end slice first, then stack each new capability on top of what already works.
-- Report implementation-item progress with lightweight markers in your reply: write \`[I-001:implemented]\` when an item's code is done, \`[I-001:validating]\` when you start verifying it. The execution status bar tracks these states.
-- For subprocess-backed verification, when a step starts a subprocess and needs its result before verifying, use literal \`waiting for\` with backoff \`5s -> 10s -> 20s -> 40s -> 80s\`, then keep polling at 80s; restart at 5s for each new subprocess.
-- Simplest implementation that fully meets the item: no speculative abstractions, configuration, or indirection; keep components modular with clearly separated concerns.
-- Architectural decisions are for the long term: no stopgaps. Do not add backward-compatibility layers, fallbacks, or migrations — remove the obsolete paths this change obsoletes.
-- Prefer established, well-maintained libraries when they reduce complexity or improve reliability; before writing your own implementation or adding a package, check the project's existing dependencies (docs and types) — never reimplement common functionality without a clear reason.
-- MINIMUM tests: trivial one-liners get no test; non-trivial logic gets exactly one minimal check; reuse the repo's test runner when one exists; when unsure, skip and emit \`[test skipped: <name>, add when <trigger>]\`.
-- After verifying an item's pass condition with its stated evidence, include \`[DONE:VC-xxx]\` in your reply.
-- When every item is done, report a completion summary.`;
+- Work through tasks in wave order (earlier waves first); within a wave, follow the listed dependency order. Wave grouping encodes which tasks could run in parallel — keep their file sets disjoint.
+- Report progress ONLY through the \`plans_update_task\` tool: status "complete" with evidence (test command output / file paths), or "skipped" with a skipReason. One call per task; statuses are immutable once set.
+- Close subtasks before their parent; a parent is auditable only when every child is terminal.
+- When every task is terminal, the independent execution reviewer verifies the plan's verification checks (${execution.items.map((item) => item.id).join(", ")}); failed checks roll their covered tasks back automatically.
+- Simplest implementation that fully meets the task: no speculative abstractions, configuration, or indirection; keep components modular with clearly separated concerns.
+- Architectural decisions are for the long term: no stopgaps. Remove the obsolete paths this change obsoletes.
+- Prefer established, well-maintained libraries when they reduce complexity; check the project's existing dependencies before adding a package or reimplementing common functionality.
+- MINIMUM tests: trivial one-liners get no test; non-trivial logic gets exactly one minimal check; reuse the repo's test runner when one exists.
+- For subprocess-backed verification, when a step needs a subprocess result before proceeding, poll with backoff \`5s -> 10s -> 20s -> 40s -> 80s\`, then keep polling at 80s.`;
 }
 
 interface SessionEntry {
@@ -1895,24 +2177,21 @@ interface SessionEntry {
 
 /**
  * Rebuild execution state from the session on start/resume. Finds the last
- * pi-plans-exec snapshot, then re-scans assistant messages after it for
- * [DONE:VC-xxx] markers so progress survives restarts.
+ * pi-plans-exec snapshot; the task tree is rebuilt from the persisted
+ * snapshot (tool-driven progress survives restarts without text replay).
  */
-export async function restoreFromSession(pi: ExtensionAPI, ctx: ExtensionContext, entries: SessionEntry[]): Promise<void> {
-	pendingExecutionFlush = false; // no flush debt survives a restart
-	goalWaitRuntime = null;
+export async function restoreFromSession(ctx: ExtensionContext, entries: SessionEntry[]): Promise<void> {
+	pendingExecutionFlush = false;
+	continuationRuntime = null;
 	resetExecutionCompactionState(ctx);
-	let snapshotIndex = -1;
 	let snapshot: ExecState | null = null;
 	for (let i = entries.length - 1; i >= 0; i--) {
 		const entry = entries[i];
 		if (entry.type === "custom" && entry.customType === "pi-plans-exec" && entry.data) {
 			snapshot = entry.data;
-			snapshotIndex = i;
 			break;
 		}
 		if (entry.type === "custom" && entry.customType === "pi-plans-exec-cleared") {
-			// Execution was explicitly stopped or completed after the last snapshot.
 			execution = null;
 			updateStatusWidget(ctx);
 			return;
@@ -1923,78 +2202,60 @@ export async function restoreFromSession(pi: ExtensionAPI, ctx: ExtensionContext
 		updateStatusWidget(ctx);
 		return;
 	}
-	// Ignore stale plans whose file vanished.
 	if (!fs.existsSync(snapshot.planPath)) {
 		execution = null;
 		updateStatusWidget(ctx);
 		return;
 	}
+	// Re-derive the task tree from the plan file (fresh parse) merged with
+	// the snapshot's persisted statuses — a stale parse cannot freeze progress.
+	let tasks: TaskView[];
+	let items: CheckItem[] = snapshot.items.map((item) => ({ ...item }));
+	let planTasks = snapshot.planTasks;
+	try {
+		const planText = fs.readFileSync(snapshot.planPath, "utf8");
+		planTasks = parsePlanTasks(planText);
+		const snapshotProgress = taskProgressMap(snapshot.tasks ?? []);
+		tasks = buildTaskView(planTasks, snapshotProgress);
+		items = parseChecklist(planText);
+	} catch {
+		tasks = snapshot.tasks;
+	}
+	// The snapshot cannot carry an in-flight round (it is memory-only); abort
+	// any live one from the previous session graph and rebuild fresh (CF2-002).
+	abortInFlightReview();
 	execution = {
 		planPath: snapshot.planPath,
-		items: snapshot.items.map((item) => ({ ...item })),
+		items,
+		planTasks,
+		tasks,
+		legacyPlan: snapshot.legacyPlan,
 		startedAt: snapshot.startedAt,
 		usage: snapshot.usage ?? { inToks: 0, outToks: 0 },
-		implItems: snapshot.implItems ?? [],
-		implStatus: { ...(snapshot.implStatus ?? {}) },
-		// D-008: chrome language is re-resolved at restore time from the
-		// CURRENT config rather than trusted from the snapshot, so a
-		// `plans set-language` change survives restarts.
 		uiLanguage: resolveUiLanguage(ctx.cwd),
-		currentI: snapshot.currentI ?? inferCurrentI(snapshot.implItems, snapshot.items, snapshot.implStatus),
-		goalWait: snapshot.goalWait
-			? { ...snapshot.goalWait }
-			: { noProgressRounds: 0, waitRounds: 0, lastMarkers: null, paused: false },
+		stall: { ...snapshot.stall, lastSnapshot: null },
+		audit: {
+			rounds: snapshot.audit?.rounds ?? 0,
+			failed: snapshot.audit?.failed ?? [],
+			undeterminable: [],
+			running: false,
+		},
+		review: { attempts: 0, consecutiveDiscards: 0, inFlight: null },
+		auditLatch: { auditedThisSettle: false, activity: 0 },
 	};
-	// Distrust the snapshot's implItems: re-parse + re-lint from the plan
-	// file so a stale empty list (older parse or format drift at snapshot
-	// time) cannot freeze a fake "I 0/0" panel after a restart.
-	try {
-		const planText = fs.readFileSync(snapshot.planPath, "utf8");
-		execution.implItems = parseImplItems(planText);
-		execution.implWarning = lintImplItems(planText);
-	} catch {
-		/* plan file unreadable mid-restore: keep the snapshot values */
-	}
-	for (let i = snapshotIndex + 1; i < entries.length; i++) {
-		const entry = entries[i];
-		if (entry.type === "custom" && entry.customType === "pi-plans-exec-cleared") {
-			execution = null;
-			break;
-		}
-		const message = entry.message;
-		if (message && message.role === "assistant") {
-			const text = message.content
-				.filter((part) => part.type === "text")
-				.map((part) => part.text ?? "")
-				.join("\n");
-			applyDoneMarkers(text);
-			applyImplMarkers(text);
-			applyCurrentIMarker(text);
-		}
-	}
-	if (execution) {
-		resetGoalWaitRuntime(ctx);
-		// Rebind the run identity after a restart so the panel's activity row
-		// (and any run-status mirroring) resolves to the active run instead of
-		// staying null until the next startExecution (CQ1/D-005 wiring gap).
-		const active = resolveActiveRun(ctx.sessionManager, ctx.cwd);
-		executionRunId = active?.run_id ?? null;
-		if (active) bindRun(ctx.sessionManager, ctx.cwd, active.run_id);
-		// D-010: replay may have advanced progress past the persisted baseline.
-		// Recompute the goal-wait markers; new progress resets the guard counters.
-		if (execution.goalWait) {
-			const markerSnapshot = goalWaitSnapshot();
-			if (markerSnapshot !== execution.goalWait.lastMarkers) {
-				execution.goalWait.lastMarkers = markerSnapshot;
-				execution.goalWait.noProgressRounds = 0;
-				execution.goalWait.waitRounds = 0;
-			}
-		}
-		persist(pi); // refresh snapshot so the next resume has less to rescan
-		if (isExecutionComplete()) {
-			// Completed during the rescan: restore the planning model on the way out.
-			await completeExecution(pi, ctx);
-		}
+	execution.stall.lastSnapshot = stallSnapshot();
+	resetContinuationRuntime(ctx);
+	const active = resolveActiveRun(ctx.sessionManager, ctx.cwd);
+	executionRunId = active?.run_id ?? null;
+	if (active) bindRun(ctx.sessionManager, ctx.cwd, active.run_id);
+	persist(ctx);
+	if (pendingAudit()) {
+		// Self-heal (v0.8): a verifying run with pending checks restarts its
+		// round exactly once per resume — the full predicate (paused, in-flight,
+		// budget) lives inside startReviewRound. Restores never grant budget.
+		latchAuditThisSettle();
+		const chain = launchReviewRound(ctx);
+		if (chain) await chain;
 	}
 	updateStatusWidget(ctx);
 }